Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

A security analyst is reviewing HTTP logs for a web application dashboard generator. During security testing, an tester supplied the parameter payload `{{7*7}}`, which resulted in the server returning a web page displaying `49`. A subsequent request containing the payload `{{self.__init__.__globals__.__builtins__.__import__('os').popen('whoami').read()}}` executed on the backend host and returned the web server execution account context. Which of the following application vulnerabilities is present in this system?

  1. Server-Side Template Injection (SSTI)Answer
  2. B
    Reflected Cross-Site Scripting (XSS)
  3. C
    Insecure Direct Object Reference (IDOR)
  4. D
    Network-level Intrusion Detection System (IDS) rule bypass

Answer

Server-Side Template Injection (SSTI) is present because user-supplied input was evaluated and executed dynamically by the server's template engine.
Server-Side Template Injection occurs when unvalidated user input is directly processed by a web application template engine. The initial payload `{{7*7}}` demonstrated template expression evaluation by outputting `49`, and the subsequent payload leveraged template engine reflection capabilities to invoke backend system commands, yielding remote code execution.

Step-by-Step Solution

1
Analyze the mathematical test payload `{{7*7}}` and its rendered output `49`.
Identified that the backend template engine dynamically evaluates syntax enclosed in template expression delimiters.
Input evaluating expressions rather than treating them as plain string literals indicates an unvalidated template evaluation vulnerability.
2
Examine the secondary command execution payload and backend response.
Confirmed Remote Code Execution (RCE) via Python template engine built-ins calling system binaries.
Server-side execution of operating system commands via template syntax confirms Server-Side Template Injection.

Key Concept

Server-Side Template Injection (SSTI)
Estimated Time:1m 15s
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic