Python Flask Jinja2 SSTI Payload Analysis
I'll walk through a common SSTI payload pulled from PayloadsAllTheThings and look at how it works, using the Flask request object to get a function, which gives access to the _globals__. From there it gets the __builtins_ dictionary and the _import_ function.
Payload: https://github.com/swisskyrepo/Payloa...
Flask Request object: https://flask.palletsprojects.com/en/...
Flask globals: https://flask.palletsprojects.com/en/...
Jinja2 attr: https://jinja.palletsprojects.com/en/...
Python Function attributes: https://docs.python.org/3/reference/d...
☕ Buy Me A Coffee: https://www.buymeacoffee.com/0xdf
[00:00] Introduction
[00:55] Data overview
[01:33] Making dummy Flask app
[02:35] Flask request object
[03:38] request in Jinja context
[04:22] attr / getattr / dot
[05:30] Using function to get _globals_
[07:40] Getting _builtins_ from _globals_
[09:31] Using _import_ to get the os module
[10:31] Getting execution
[11:50] Conclusion
#ssti #ctf #python #jinja2