Server Side Template Injection with Flask and Jinja2

Introduction Last week I took part in a CTF, and one of the problems from the “Web” category seems pretty intriguing to me. Although I was able to get the Flag, but couldn’t submit the flag in time, so no points for me 😔. The interesting thing about this problem was, that the technology which needed to be exploited was something I am pretty familiar with and had a lot of experience in, but still, even after working with that tech stack for years, I was unaware of this vulnerability. So I thought of publishing this write-up to share some of my findings and help you better understand how to write safe code. Even if you are not interested in security research and CTF’s I would still recommend you read this write-up, it may help your company save a fortune in post data breach marketing campainging 😁 and it will make you a better web developer for sure. ...

June 13, 2020 · 8 min · Shubham Singh