Server Side Template injection

# Source Code Examples {% hint style="danger" %} Page under construction {% endhint %} ## OWASP Juice Shop The OWASP Juice Shop application contains a SSTI on the profile page . This profile page allows users to change their username. The code that handles this functionality is /routes/userProfile.js. This code uses the templating engine Pug. It uses the pug file in views/userProfile.pug. The getUserProfile function reads the userProfile.pug file on line 17. Then the logged in User is retrieved on lines 19-21. A template variable is created on line 22, the username ``` /* * Copyright (c) 2014-2021 Bjoern Kimminich. * SPDX-License-Identifier: MIT */ const fs = require('fs') const models = require('../models/index') const utils = require('../lib/utils') const insecurity = require('../lib/insecurity') const challenges = require('../data/datacache').challenges const pug = require('pug') const config = require('config') const themes = require('../views/themes/themes').themes module.exports = function getUserProfile () { return (req, res, next) => { fs.readFile('views/userProfile.pug', function (err, buf) { if (err) throw err const loggedInUser = insecurity.authenticatedUsers.get(req.cookies.token) if (loggedInUser) { models.User.findByPk(loggedInUser.data.id).then(user => { let template = buf.toString() let username = user.dataValues.username if (username.match(/#\{(.*)\}/) !== null && !utils.disableOnContainerEnv()) { req.app.locals.abused_ssti_bug = true const code = username.substring(2, username.length - 1) try { username = eval(code) // eslint-disable-line no-eval } catch (err) { username = '\\' + username } } else { username = '\\' + username } const theme = themes[config.get('application.theme')] template = template.replace(/_username_/g, username) template = template.replace(/_emailHash_/g, insecurity.hash(user.dataValues.email)) template = template.replace(/_title_/g, config.get('application.name')) template = template.replace(/_favicon_/g, favicon()) template = template.replace(/_bgColor_/g, theme.bgColor) template = template.replace(/_textColor_/g, theme.textColor) template = template.replace(/_navColor_/g, theme.navColor) template = template.replace(/_primLight_/g, theme.primLight) template = template.replace(/_primDark_/g, theme.primDark) template = template.replace(/_logo_/g, utils.extractFilename(config.get('application.logo'))) const fn = pug.compile(template) const CSP = `img-src 'self' ${user.dataValues.profileImage}; script-src 'self' 'unsafe-eval' https://code.getmdl.io http://ajax.googleapis.com` utils.solveIf(challenges.usernameXssChallenge, () => { return user.dataValues.profileImage.match(/;[ ]*script-src(.)*'unsafe-inline'/g) !== null && utils.contains(username, '') }) res.set({ 'Content-Security-Policy': CSP }) res.send(fn(user.dataValues)) }).catch(error => { next(error) }) } else { next(new Error('Blocked illegal activity by ' + req.connection.remoteAddress)) } }) } function favicon () { return utils.extractFilename(config.get('application.favicon')) } } ``` ### Extermely Vulnerable Web App (XVWA) (PHP) ``` Server Side Template injection render($name); echo "Hello $result"; } catch (Exception $e) { die ('ERROR: ' . $e->getMessage()); } } ?>

Hint:

1. Template Engine used is TWIG.
2. Loader function used = "Twig_Loader_String"

``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://evanluke.gitbook.io/appsec/injection/template-injection/source-code-examples.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.