webProeasy
MailPilot — SSTI in Template Preview
hackadvisor
Task: Flask/Jinja2 email marketing platform with template preview feature that renders user-supplied templates via render_template_string(). Solution: Exploited SSTI through lipsum.__globals__['os'].popen() to read /tmp/flag.txt.
$ ls tags/ techniques/
ssti_jinja2rce_via_lipsum_globalstemplate_preview_abuse
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 237 — MailCraft — SSTI in Email Template Preview— hackadvisor
- [web][Pro]Lab 225 — MailPulse — SSTI in Campaign Template Preview— hackadvisor
- [web][Pro]Lab 225 — MailPulse — SSTI in Campaign Template Preview— hackadvisor
- [web][Pro]Lab 133 — MailForge — SSTI via Handlebars Template Preview— hackadvisor
- [web][Pro]Lab 236 — PulseAlert — Blind SSTI via Notification Template Engine— hackadvisor