Advanced·450 points·12 solves
Welcomely — Server-Side Template Injection
Learn server-side template injection: when user input is placed into a template that the server then renders, the template engine evaluates the input as an expression — a short path from "personalized greeting" to arbitrary code execution on the server.
Welcomely renders "Hello, " + name + "! Welcome aboard." with Jinja2 (Flask's engine). Because your name is concatenated into the template SOURCE and then rendered, Jinja evaluates any {{ ... }} expression you include — that's the injection. First confirm it by sending a name of {{7*7}}: if the page greets "Hello, 49!" the expression was evaluated. From there, Jinja lets you walk from harmless built-in objects to Python's object model and out to the os module — e.g. via config.__class__.__init__.__globals__['os'] — giving you os.environ and os.popen for full code execution. The flag is the server's $FLAG environment variable. The fix is to never build template source from user input: render a fixed template and pass the name as a DATA variable, and sandbox the engine.
Your tasks
1
Generate a greeting
Open the lab and enter a normal name. The page greets you by it — your input goes into the greeting.
2
Test for evaluation
Enter {{7*7}} as your name. If the greeting reads 'Hello, 49!' then your input is being evaluated as a template expression, not shown as text.
3
Reach the object model
Jinja gives access to Python objects. From a built-in like `config` you can reach its class, then __init__.__globals__, which imports the os module.
4
Read the environment
With the os module in hand, read os.environ (or run a command with os.popen). The flag is the $FLAG variable.
5
Capture the flag
The rendered greeting contains the flag from the environment.
Submit the flag
Start the lab, capture the flag from the running machine, and submit it here.