Case Study: Craft CMS
The example below is based on OffSec's WEB-200 course.
The source code of the web application contains some clues. More specifically, it discloses that the Craft CMS is used and the use of [] in the name attribute of the input field indicates the usage of the PHP programming language (Figure 1).
Performing a dirbusting with ffuf , we find that there is an /admin directory which further confirms that we are using the Craft CMS (Figure 2).
/admin directory validates the usage of the Craft CMS.The home page of the web application provides a way to send an email to the site's administrator. Emails are great targets for SSTI as they consist of mainly generic elements which are then tailored to the user using a templating engine. Searching for "Craft CMS templating engine" reveals that Twig is used (Figure 3).
We can send an email containing a Twig-specific payload to form an out-of-band communication.
When we send the email the payload is executed and we receive a response back.
To exfiltrate data in Twig, we use the tilde character (~) for string concatenation, which allows us to append the exfiltrated data to a GET request and the set tag to declare variables. Additionally, we apply the url_encode method method to the exfil variable to ensure our payload is properly URL-encoded.
In the response, we confirm that we have achieved RCE.
Last updated
Was this helpful?