HackTheBox : JinjaCare Writeup

Short summary

A HackTheBox CTF writeup for JinjaCare, a Flask vaccination verification app. The exploit chain goes from wkhtmltopdf local-file injection to disclose source code, revealing a post-substitution render_template_string() call vulnerable to Server-Side Template Injection. The SSTI is exploited via a Jinja2 sandbox-escape gadget chain to achieve root-level remote code execution.

• •Flask-based CTF writeup chaining wkhtmltopdf file injection to source code disclosure
• •Post-substitution render_template_string() enables Jinja2 SSTI sandbox escape
• •Exploitation achieves root-level RCE via self.__init__.__globals__ gadget chain

Generated with AI, which can make mistakes.