Examkin

Question

Difficulty: HardApplication and Software Vulnerabilities

During a routine incident investigation, a security analyst reviews web application gateway logs for a custom automated reporting microservice. The logs contain consecutive HTTP POST requests targeting the endpoint `/api/v1/generate-report` with the body payload `template_header={{7*7}}`, which returned a `200 OK` status with `49` rendered in the response preview. Subsequent log entries show the payload modified to `template_header={{self.__init__.__globals__['__builtins__']['__import__']('os').popen('id').read()}}`, which returned operating system user identity context. Which of the following vulnerabilities is present in the application, and what is the primary mitigation strategy to prevent exploitation?

  1. Server-Side Template Injection (SSTI); enforce strict context-aware input sanitization, separate user data from template logic, and utilize sandboxed execution environments.Answer
  2. B
    SQL Injection (SQLi); replace dynamic inline database queries with parameterized prepared statements and stored procedures.
  3. C
    Reflected Cross-Site Scripting (XSS); implement client-side HTML entity encoding and configure restrictive Content Security Policy (CSP) headers.
  4. D
    Broken Object Level Authorization (BOLA); implement role-based access control lists and enforce server-side session authentication checks on API endpoints.

Answer

The application is vulnerable to Server-Side Template Injection (SSTI). The primary mitigation is to enforce strict input sanitization, separate user input from template logic, and execute template processing within a sandboxed environment.
The option identifying Server-Side Template Injection (SSTI) correctly diagnoses the vulnerability. SSTI occurs when an application embeds unvalidated user input directly into a server-side template string prior to rendering. The initial probe (`{{7*7}}` evaluating to `49`) proves that template syntax is being evaluated on the server, while the follow-up payload uses object reflection to invoke system commands (`os.popen`), leading to remote code execution. Safe implementation requires separating user data from template layout, sanitizing inputs, and utilizing sandboxed rendering engines.

Step-by-Step Solution

1
Analyze the log entries for payload characteristics and application response behaviour.
The initial string `{{7*7}}` evaluated mathematically to `49` on the server side, confirming that the server processes mathematical operations within expression delimiters.
Testing simple mathematical operations within template brackets (such as double curly braces) is a standard diagnostic method to detect active template engine expression evaluation.
2
Evaluate the secondary payload `{{self.__init__.__globals__...}}` to determine the severity and scope of the exploit.
The secondary payload leveraged Python reflection mechanisms to reach the underlying `os` module, executing `id` command-line calls directly on the host operating system.
This confirms full Remote Code Execution (RCE) via Server-Side Template Injection rather than database querying or client-side script execution.
3
Identify the appropriate remediation controls for Server-Side Template Injection.
Disallow raw user input from being directly concatenated into template strings, implement logic-less templates, and run rendering engines in restricted sandboxes.
Preventing template engine access to underlying system reflection structures effectively closes the attack surface.

Key Concept

Server-Side Template Injection (SSTI)
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic