Basic server-side template injection
Last updated
Was this helpful?
Last updated
Was this helpful?
Homepage
Before testing for vulnerabilities, it’s essential to understand the application’s functionality. The homepage displays a shopping interface with products. When clicking on a product, a message stating, "Unfortunately, this product is out of stock," is displayed.
Using Burp send the request to the repeater and examine the parameters passed when interacting with a product.
The message parameter is present in the request. This parameter might be used to dynamically render content on the webpage.
Server-side template injection occurs when user inputs are passed directly into the server's template engine without proper sanitization. By crafting specific payloads, we can test if the message parameter is vulnerable.
Inject a basic payload: {{7*7}}.
Expected Output: If vulnerable, the result should display 49 (calculated value).
Observation: The output displays {{7*7}}, meaning this specific syntax did not trigger the vulnerability.
Exploring other template engines.
Attempted payload: <%= 7*7 %> (Ruby's Embedded Ruby, ERB syntax).
Result: Successfully evaluated to 49. This confirms the application uses the ERB engine, making it vulnerable to Ruby-based template injection.
Thought Process:
After confirming template injection, the next step is to assess whether arbitrary code can be executed.
The response contains system information (uid=12002(carlos) gid=12002(carlos)), confirming RCE.
Thought Process:
The goal is to delete the morale.txt file from Carlos's home directory. First, we need to confirm its presence in the current directory.
The output lists morale.txt as a file in the current directory.
Now that the target file is identified, the next step is to delete it using the rm command.
After executing the payload, the lab confirms successful completion.
