Stickers - NahamCon 2023 Writeup

SSTI in a Python/Flask sticker generator. User input rendered directly via Jinja2 template without sanitization → OS command execution via __import__.

🚩 Challenge Overview

  • Platform/Event: NahamCon 2023
  • Difficulty: Medium
  • Points: 497
  • Solves: 88
  • Category: Web
  • Tags: SSTI, Jinja2, Flask, RCE

📝 Description

SSTI in a Python/Flask sticker generator. User input rendered directly via Jinja2 template without sanitization → OS command execution via import.

💡 Solution / Approach