Lab 236 — PulseAlert — Blind SSTI via Notification Template Engine

hackadvisor

Task: Flask/Jinja2 notification platform with template test-send feature that renders user input server-side but doesn't return output (blind SSTI). Solution: Error-based exfiltration using exec('raise Exception(data)') via lipsum.__globals__ to leak flag from environment variable.