Examkin

Question

Difficulty: Very hardApplication and Software Vulnerabilities

A security engineer is analyzing HTTP request logs for a document generation microservice after a Security Information and Event Management (SIEM) alert triggered on high CPU utilization. The service accepts custom template strings from authenticated users to format PDF invoices. Inspection of an isolated POST request payload reveals the following body:

`{"account_id": 9402, "template_body": "{{ self._TemplateReference__context.namespace.__init__.__globals__['os'].popen('id').read() }}"}`

The microservice returned an HTTP 200 OK response containing the payload output: `uid=1001(appworker) gid=1001(appworker)`.

Which of the following vulnerabilities was exploited in this incident, and what primary software control best prevents this vulnerability?

  1. Server-Side Template Injection (SSTI); remediate by using a sandboxed rendering engine or avoiding reflection to native language globals during template evaluation.Answer
  2. B
    Cross-Site Scripting (XSS); remediate by configuring HTTP-only flags on session cookies and enforcing strict Content Security Policy (CSP) headers.
  3. C
    OS Command Injection; remediate by enforcing parameterized SQL database queries and input length restrictions on POST requests.
  4. D
    Broken Object Level Authorization (BOLA); remediate by implementing strict role-based access control (RBAC) checks on the endpoint.

Answer

The microservice is vulnerable to Server-Side Template Injection (SSTI), which is best mitigated by using a secure, sandboxed rendering context and preventing access to native language globals.
The correct answer identifies Server-Side Template Injection (SSTI). The payload leverages template expression syntax (`{{ ... }}`) combined with language-level reflection (`__globals__['os'].popen()`) to evaluate arbitrary shell commands on the hosting server. Effective defense requires running template engines within sandboxed execution boundaries or restricting access to native language globals.

Step-by-Step Solution

1
Analyze the request payload structure and syntax in the log snippet.
The payload uses double curly braces `{{ ... }}` to inject template expression syntax combined with Python object reflection (`__globals__['os'].popen()`).
Identifying template expression delimiters helps distinguish server-side template rendering abuse from direct web script or database injection.
2
Evaluate the execution environment and response behavior.
The server executed the `id` system binary and returned `uid=1001(appworker)`, proving that code execution occurred on the server within the template processing engine.
Execution on the server confirms a server-side injection vulnerability (SSTI) rather than a client-side execution flaw like XSS.
3
Determine the appropriate remediation strategy.
The vulnerability is remediated by configuring the template engine in a restricted, sandboxed mode where dangerous built-ins, reflection attributes, and OS execution modules cannot be accessed.
Disabling dangerous reflection and isolating template execution prevents malicious input from invoking underlying system binaries.

Key Concept

Server-Side Template Injection (SSTI)
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic