webProeasy

Lab 225 — MailPulse — SSTI in Campaign Template Preview

hackadvisor

Task: MailPulse email marketing platform (Flask/Jinja2) with campaign template preview endpoint vulnerable to SSTI. Solution: Inject {{lipsum.__globals__['os'].popen('cat /root/flag.txt').read()}} via body_html field in POST /campaigns/0/preview to achieve RCE and read the flag.

$ ls tags/ techniques/
flaskrcesstipythonjinja2template_injectiondecoy_flagemail_platformcampaign_previewlipsum
decoy_flag_recognitionjinja2_ssti_via_render_template_stringrce_via_lipsum_globals_os_popencampaign_preview_abuse
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups