Dangerous usage of templating language can lead to remote code execution
- Dominant language
- TypeScript
- Stars
- 40k
- Forks
- 2.4k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 61
Description
**Describe the bug**
It is possible to craft malicious import files (Swagger, Insomnia v4, ... ) that can lead, once imported, to execution of unwanted code due to SSTI in Nunjucks.
**To Reproduce**
1. Create a basic Swagger JSON file with only one endpoint.
2. Put the following piece of Javascript as an URI
```javascript
{{ range.constructor('return global.process.mainModule.require(\"child_process\").execSync(\"touch /tmp/poc\")')() }}
```
4. Import it in an Insomnia workspace
3. A "poc" file should be created in /tmp/
**Expected behavior**
Since this can execute any command, this is very dangerous and the user should be at least warned from importing Swagger from unknown source.
**Desktop:**
- OS: Arch Linux
- Installation Method: YAY
- App Version : v7.1.1
**Additional informations**
I only tested Swagger file format and Insomnia export file format but i'm pretty sure that other import file format are vulnerable because the vulnerability happen when handling the content of an URL.
You can understand how the exploit is working by reading the following blogpost :
[Sandbox breakout Nunjucks template engine](http://disse.cting.org/2016/08/02/2016-08-02-sandbox-break-out-nunjucks-template-engine)
Contributor guide
Research direction
Start by tracing how Swagger and Insomnia v4 imports handle URL content and where Nunjucks templates are evaluated. Reproduce the supplied payload in an isolated environment, then determine the safe import behavior and verify that arbitrary command execution is no longer possible across the affected import formats.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 20/100