webProeasy

Lab 383 — ConnectFlow — SSTI

hackadvisor

Task: Flask API connector platform with Jinja2-rendered connector descriptions. Solution: SSTI via unsandboxed render_template_string() in description field, escalated to RCE via lipsum.__globals__['os'].popen() to read /root/flag.txt.

$ ls tags/ techniques/
flaskrcesstipythonjinja2template_injectiondecoy_flagapi_platformconnector_builder
decoy_flag_recognitionjinja2_ssti_via_render_template_stringrce_via_lipsum_globals_os_popen
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups