Jinja2 SSTI
Learn & practice AWS Hacking:
HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: 
HackTricks Training GCP Red Team Expert (GRTE)
Lab
from flask import Flask, request, render_template_string
app = Flask(__name__)
@app.route("/")
def home():
if request.args.get('c'):
return render_template_string(request.args.get('c'))
else:
return "Hello, send someting inside the param 'c'!"
if __name__ == "__main__":
app.run()Misc
Debug Statement
If the Debug Extension is enabled, a debug tag will be available to dump the current context as well as the available filters and tests. This is useful to see what’s available to use in the template without setting up a debugger.
Source: https://jinja.palletsprojects.com/en/2.11.x/templates/#debug-statement
Dump all config variables
Jinja Injection
First of all, in a Jinja injection you need to find a way to escape from the sandbox and recover access the regular python execution flow. To do so, you need to abuse objects that are from the non-sandboxed environment but are accessible from the sandbox.
Accessing Global Objects
For example, in the code render_template("hello.html", username=username, email=email) the objects username and email come from the non-sanboxed python env and will be accessible inside the sandboxed env.
Moreover, there are other objects that will be always accessible from the sandboxed env, these are:
Recovering <class 'object'>
Then, from these objects we need to get to the class: <class 'object'> in order to try to recover defined classes. This is because from this object we can call the __subclasses__ method and access all the classes from the non-sandboxed python env.
In order to access that object class, you need to access a class object and then access either __base__, __mro__()[-1] or .mro()[-1]. And then, after reaching this object class we call __subclasses__().
Check these examples:
RCE Escaping
Having recovered <class 'object'> and called __subclasses__ we can now use those classes to read and write files and exec code.
The call to __subclasses__ has given us the opportunity to access hundreds of new functions, we will be happy just by accessing the file class to read/write files or any class with access to a class that allows to execute commands (like os).
Read/Write remote file
RCE
To learn about more classes that you can use to escape you can check:
Bypass Python sandboxesFilter bypasses
Common bypasses
These bypass will allow us to access the attributes of the objects without using some chars. We have already seen some of these bypasses in the examples of the previous, but let sumarize them here:
Avoiding HTML encoding
By default Flask HTML encode all the inside a template for security reasons:
The safe filter allows us to inject JavaScript and HTML into the page without it being HTML encoded, like this:
RCE by writing an evil config file.
Without several chars
Without {{ . [ ] }} _
Jinja Injection without <class 'object'>
From the global objects there is another way to get to RCE without using that class.
If you manage to get to any function from those globals objects, you will be able to access __globals__.__builtins__ and from there the RCE is very simple.
You can find functions from the objects request, config and any other interesting global object you have access to with:
Once you have found some functions you can recover the builtins with:
Fuzzing WAF bypass
Fenjing https://github.com/Marven11/Fenjing is a tool that its specialized on CTFs but can be also useful to bruteforce invalid params on a real scenario. The tool just spray words and queries to detect filters, searching for bypasses, and also provide a interactive console.
English-Chinese Google translation
References
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Last updated