webPromedium

Lab 389 — PulseBoard — SSTI in Custom Widget Template Builder

hackadvisor

Task: Flask analytics dashboard (PulseBoard) with custom widget builder accepting Jinja2 template code; no sandboxing applied. Solution: inject {{7*7}} to confirm SSTI, escalate via lipsum.__globals__['os'].popen() for RCE, read /root/flag.txt.

$ ls tags/ techniques/
flaskrcesstipythonjinja2werkzeugtemplate_injectiondecoy_flaghoneypot_flagcustom_templatewidget_builder
decoy_flag_recognitionjinja2_ssti_via_render_template_stringflask_config_leakpython_mro_chain_traversalrce_via_lipsum_globals_os_popen
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups