Django - SSTI

---

Description

Write Up: Guillaume
Créateur: WOCSA
Difficulté: Inconnu

Enoncé

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

---

Solution détaillée

Exploitation

Create a user with a template interpration name like {% debug %}. Then connect yourself and logout, the name will be render and print django debug datas.

PoC

We can use this username {{ messages.storages.0.signer.key }} to leak the jwt secret or we can XSS with {{ '<script>alert(3)</script>' }}

Risk

There is a high risk to XSS, leak data, even RCE in certains circumstances

Remediation

Disable the rendering of username in logout

---