search

Case Study: Craft CMS

The example below is based on OffSec's WEB-200arrow-up-right course.

The source code of the web application contains some clues. More specifically, it discloses that the Craft CMS is used and the use of [] in the name attribute of the input field indicates the usage of the PHP programming language (Figure 1).

Figure 1: Inspecting the source code of the homepage.

Performing a dirbusting with ffuf , we find that there is an /admin directory which further confirms that we are using the Craft CMS (Figure 2).

Figure 2: The /admin directory validates the usage of the Craft CMS.

The home page of the web application provides a way to send an email to the site's administrator. Emails are great targets for SSTI as they consist of mainly generic elements which are then tailored to the user using a templating engine. Searching for "Craft CMS templating enginearrow-up-right" reveals that Twig is used (Figure 3).

Figure 3: Enumerating Craft's templating engine.

We can send an email containing a Twig-specific payload to form an out-of-band communication.

When we send the email the payload is executed and we receive a response back.

To exfiltrate data in Twig, we use the tilde characterarrow-up-right (~) for string concatenation, which allows us to append the exfiltrated data to a GET request and the setarrow-up-right tag to declare variables. Additionally, we apply the url_encodearrow-up-right method method to the exfil variable to ensure our payload is properly URL-encoded.

In the response, we confirm that we have achieved RCE.

PreviousMakoNextXXEI

Last updated