Server Side Template Injection 01

In this exercise, we delve into a real-world example of a Server-Side Template Injection (SSTI) vulnerability as reported on Hackerone. The lab specifically targets a bug found in the 404 error management of a Flask web application. By manipulating the error handling code, you can inject malicious payloads that lead to code execution.

The lab begins with a detailed code review of the vulnerable Flask application. It highlights how the use of {{''.__class__.mro()[1].__subclasses__()}} can expose various Python classes, including subprocess.Popen, which can then be exploited to run arbitrary commands. The lab guides you through identifying the right index for subprocess.Popen and crafting the payload to achieve remote code execution. Additionally, the importance of reading Python documentation is emphasized to ensure the correct syntax and options are used.