The OWASP Juice Shop application contains a SSTI on the profile page http://localhost:3000/profile. This profile page allows users to change their username. The code that handles this functionality is /routes/userProfile.js. This code uses the templating engine Pug. It uses the pug file in views/userProfile.pug. The getUserProfile function reads the userProfile.pug file on line 17. Then the logged in User is retrieved on lines 19-21. A template variable is created on line 22, the username
Copy /*
* Copyright (c) 2014-2021 Bjoern Kimminich.
* SPDX-License-Identifier: MIT
*/
const fs = require('fs')
const models = require('../models/index')
const utils = require('../lib/utils')
const insecurity = require('../lib/insecurity')
const challenges = require('../data/datacache').challenges
const pug = require('pug')
const config = require('config')
const themes = require('../views/themes/themes').themes
module.exports = function getUserProfile () {
return (req, res, next) => {
fs.readFile('views/userProfile.pug', function (err, buf) {
if (err) throw err
const loggedInUser = insecurity.authenticatedUsers.get(req.cookies.token)
if (loggedInUser) {
models.User.findByPk(loggedInUser.data.id).then(user => {
let template = buf.toString()
let username = user.dataValues.username
if (username.match(/#\{(.*)\}/) !== null && !utils.disableOnContainerEnv()) {
req.app.locals.abused_ssti_bug = true
const code = username.substring(2, username.length - 1)
try {
username = eval(code) // eslint-disable-line no-eval
} catch (err) {
username = '\\' + username
}
} else {
username = '\\' + username
}
const theme = themes[config.get('application.theme')]
template = template.replace(/_username_/g, username)
template = template.replace(/_emailHash_/g, insecurity.hash(user.dataValues.email))
template = template.replace(/_title_/g, config.get('application.name'))
template = template.replace(/_favicon_/g, favicon())
template = template.replace(/_bgColor_/g, theme.bgColor)
template = template.replace(/_textColor_/g, theme.textColor)
template = template.replace(/_navColor_/g, theme.navColor)
template = template.replace(/_primLight_/g, theme.primLight)
template = template.replace(/_primDark_/g, theme.primDark)
template = template.replace(/_logo_/g, utils.extractFilename(config.get('application.logo')))
const fn = pug.compile(template)
const CSP = `img-src 'self' ${user.dataValues.profileImage}; script-src 'self' 'unsafe-eval' https://code.getmdl.io http://ajax.googleapis.com`
utils.solveIf(challenges.usernameXssChallenge, () => { return user.dataValues.profileImage.match(/;[ ]*script-src(.)*'unsafe-inline'/g) !== null && utils.contains(username, '<script>alert(`xss`)</script>') })
res.set({
'Content-Security-Policy': CSP
})
res.send(fn(user.dataValues))
}).catch(error => {
next(error)
})
} else {
next(new Error('Blocked illegal activity by ' + req.connection.remoteAddress))
}
})
}
function favicon () {
return utils.extractFilename(config.get('application.favicon'))
}
}
Extermely Vulnerable Web App (XVWA) (PHP)
Copy
<html>
<head><title>Server Side Template injection</title></head>
<body><form action="" method="GET">
<label>Enter your Name:</label><br/><input type="text" name="name"><br><br>
<input type="submit" name="submit" value="Enter"><br><br>
</form>
<?php
if (isset($_GET['submit'])) {
$name=$_GET['name'];
// include and register Twig auto-loader
include 'vendor/twig/twig/lib/Twig/Autoloader.php';
Twig_Autoloader::register();
try {
// specify where to look for templates
$loader = new Twig_Loader_String();
// initialize Twig environment
$twig = new Twig_Environment($loader);
// set template variables
// render template
$result= $twig->render($name);
echo "Hello $result";
} catch (Exception $e) {
die ('ERROR: ' . $e->getMessage());
}
}
?>
<p>
<h3>Hint:</h3>
<b>1.</b> Template Engine used is TWIG.<br>
<b>2.</b> Loader function used = "Twig_Loader_String"<br>
</p>
</body>
</html>