webPromedium
Lab 134 — DocForge — FreeMarker SSTI Sandbox Escape via ?api Built-in
hackadvisor
Task: DocForge collaborative wiki platform (Java/FreeMarker) with template preview endpoint that renders user-supplied FreeMarker code server-side; ?new() built-in is blocked. Solution: Bypass sandbox via ?api built-in to access Java reflection API through article model variable, chain Class.forName → Runtime.getRuntime().exec() to achieve RCE and read /root/flag.txt.
$ ls tags/ techniques/
decoy_flag_recognitionfreemarker_ssti_via_template_previewsandbox_escape_via_api_builtinjava_reflection_chain_rceprocess_output_capture_via_scanner
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]SendForge— hackadvisor
- [web][Pro]Lab 133 — MailForge — SSTI via Handlebars Template Preview— hackadvisor
- [web][Pro]ContentForge— hackadvisor
- [web][Pro]Lab 320 — BuildForge — Path Traversal to RCE via CLI @File Expansion— hackadvisor
- [web][Pro]Lab 135 — PageCraft — SSTI in CMS Page Editor— hackadvisor