Kamoo Ente ea Template ea Lehlakore la Seva e Sebetsang Kateng ka Morao ho Liketsahalo
Ho kenngoa ha template lehlakoreng la seva ho etsahala ha tlhahiso ea mosebelisi e kenngoa ka ho toba ka har'a enjene ea template 'me e hlahlojoa ntle le ho hloekisoa hantle kapa ho itšehla thajana. Sena se baka bofokoli ba SSTI bo lumellang mohlaseli ho kenya mojaro o entsoeng ka ho khetheha oa SSTI (mohlala, {{7*7}} ho Jinja2), eo enjene e tla e hlahloba, e nolofalletsa ntho e 'ngoe le e 'ngoe ho tloha ho senoloeng ha data ho ea ho phethahatsong ea khoutu e sa reroang moelelong oa seva. Hobane lienjene tse fapaneng tsa template li pepesa lintho le li-API tse fapaneng, SSTI payloads lia fapana ka sethala empa li arolelana kotsi e tšoanang: li lumella tlhahiso e sa tšepahaleng ho phonyoha phallo ea tlhahiso e lebelletsoeng 'me lia e phethahatsa nakong ea ts'ebetso ea sesebelisoa, hangata e lebisang ts'ebetsong e felletseng ea khoutu e hole kapa motsamao o ka thoko haeba o sa laoloe.
Mohlala o fokolang haholo oa ho ba kotsing ho Jinja2
from flask import request, render_template_string @app.route("/hello") def hello(): name = request.args.get("name", "world") # ❌ Vulnerable: directly rendering user input return render_template_string("Hello " + name) Haeba mosebelisi a romela ?name={{7*7}}, sesebelisoa se tla se hlahloba, se khutlise Lumela 49. Ke buka ea thuto ea ho ba kotsing ea SSTI.
Mohlala o fokolang o kotsing ho Twig
// ❌ Vulnerable Twig usage $template = $twig->createTemplate("Welcome " . $_GET['user']); echo $template->render([]); Mohlaseli a ka kenya mojaro oa SSTI joalo ka {{7*7}} ho paka ts'ebetso ea khoutu. Kotsi: ho kenya feela ho ka fetela ho ho bala difaele, ho phethahatsa ditaelo tsa OS, kapa ho fetela ka botebo ho meralo ya motheo.
Litšusumetso tsa Lefatše la 'Nete: Mejaro ea SSTI e Bakang Ts'ebetso ea Khoutu e hole
Hang ha bofokoli ba SSTI bo le teng, bahlaseli ba leka ho tloha lipalo tsa bopaki ba khopolo-taba ho ea ho tse felletseng RCELienjine tse fapaneng tsa template li sebetsana le mojaro o lefang ka tsela e fapaneng.
Mejaro ea Jinja2
- {{7*7}} → phethahatso ea lipalo
- {{config.items()}} → di-config tsa seva tse dutlang.
- {{ ”.__class__.__mro__[2].__subclasses__() }} → tsela e eang ho RCE
Mejaro ea lebelo
- #sete($x=”7″)${x} → tsela e sa enteng
- #set($a=$class.inspect(“java.lang.Runtime”) → phihlello e tobileng ea nako ea ho sebetsa
Mejaro e menyenyane
- {{7*7}} → lipalo
- {{app.request.server.all}} → diphetoho tsa tikoloho
- {{_self.env.registerUndefinedFilterCallback(‘system’)}} → ts'ebetso ea khoutu
Mejaro ena ea SSTI e bontša kamoo bofokoli bo tšoanang lienjineng tse fapaneng bo lebisang ho tse fapaneng sebelisa litsela hampe, empa kamehla li kotsi.
Moo Ente ea Template ea Lehlakore la Seva e Ipatang ho CI/CD-Lisebelisoa tse tsamaisoang
Ho kenngoa ha template ea lehlakoreng la seva ha se kotsi feela ea app ea webo; ho hlaha ho mokhoa oa kajeno oa CI/CD pipelines le eena o. Libaka tse tloaelehileng tsa ho ipata li kenyelletsa:
- Lichate tsa Helm ho Kubernetes, moo boleng ba template bo hlahisoang ka mokhoa o feto-fetohang
- Litemana tsa imeile tse kopanyang lintho tse kenang tse laoloang ke basebelisi
- Dashboards moo likhoele tsa lipotso kapa data ea litlhophiso li kenngoang ka har'a litempele
- Lingoloa tsa DevOps tse hlahisang HTML/Markdown li sebelisa lienjine tsa template.
mohlala:
# ❌ Insecure Helm values with user input configMap: appMessage: "{{ .Values.message }}" If.Melaetsa.ea.boleng e tsoa ho kenyelletso e sa tšepahaleng, e hlahisa ente ea template e lehlakoreng la seva ts'ebetsong ea hau pipeline ka boeona.
Ho Thibela SSTI ka Mekhoa e Sireletsehileng ea Template le Tlhahlobo e sa Fetoheng
Ho fokotsa bofokodi ba SSTI ho hloka mekhoa e metle ea ho ngola khoutu le ho lemoha esale pele.
Mekhoa e sireletsehileng
- ❌ U se ke ua sebelisa khoele_ea_template kapa e lekanang
- ✅ Sebelisa lifaele tsa template tse hlalositsoeng esale pele 'me u fetise mefuta-futa e hloekisitsoeng
- ✅ Lienjine tsa template ea Sandbox ha li fumaneha
- ✅ Netefatsa le ho baleha tlhahiso ea mosebelisi pele o e hlahisa
Ho se sireletsehe ha ho bapisoa le ho sebetsana le di-cookie ka mokhoa o sireletsehileng (kotsi e amanang le ho kenya)
# ❌ Insecure: session cookie without flags response.set_cookie("session", token) # ✅ Secure: session cookie hardened response.set_cookie("session", token, httponly=True, secure=True, samesite="Strict") Lethathamo le Lenyenyane la Litlhahlobo bakeng sa Bahlahisi
- Le ka mohla u se ke ua fana ka tlhahiso e sa tsoakoang ea mosebelisi ka kotloloho
- Sebelisa litempele tse nang le sandbox ha li tšehetsoa
- Hloekisa le ho netefatsa mefuta eohle ea litempele
- Qoba bahlahlobi ba litempele tse ikhethileng
- Skena khoutu bakeng sa khoele_ea_template kapa mekhoa ea ho kopanya likhoele
Tlhahlobo e tsitsitseng 'me linter li ka tšoaea meaho e kotsi pele e fihla tlhahisong.
Ho kenya Litlhahlobo tsa SSTI ho DevSecOps Pipelines
Ho fumana ente ea template ea lehlakoreng la seva esale pele ho theko e tlase ebile ho bolokehile ho feta ho e lokisa hamorao. Lihlopha tsa DevSecOps li lokela ho kenya licheke ho pipelines:
- Commit hooks: hana commits tse nang le mesebetsi e kotsi (khoele_ea_template)
- Bahlahlobi ba tsitsitseng: skena bakeng sa kotsi ea ho kenngoa ha template ea lehlakoreng la seva khoutung ea template
- Netefatso ea ho itšetleha: tshwaya dienjene tsa template tse siilweng ke nako tse nang le bofokodi bo tsebahalang ba SSTI
- Pipeline liheke: ho kopana ha li-block ho fihlela licheke tsa SSTI li feta
Ka ho etsa hore ho lemoha mojaro oa SSTI e be karolo ea CI/CD, o thibela khoutu e ka sebelisoang hampe hore e se ke ea romelloa.
Se ke oa Lumella Ente ea Template ea Lehlakore la Seva ho Kena ka har'a Stack ea Hao
Ho kenngoa ha template ka lehlakoreng le le leng la seva ho ka eketseha ho tloha maqhekeng a lipalo ({{7*7}}) ho phethahatsong e felletseng ya khoutu e hole. Bofokodi ba SSTI ha bo hlahe feela mananeong a webo empa hape le ho CI/CD pipelines, lichate tsa Helm, le dithempleite tsa imeile.
Bohlokoa ba ho nka
- Le ka mohla u se ke ua kenya mongolo o sa tsoakoang oa mosebelisi ka har'a litempele
- Netefatsa le ho hlwekisa di-variable tsohle tse fetohang
- Lienjine tse fapaneng (Jinja2, Velocity, Twig) li na le meroalo e fapaneng ea SSTI, empa kaofela li ka sebelisoa e le libetsa.
- Sebelisa tlhahlobo e sa fetoheng le liheke tse hlolehang ka potlako ho pipelines
- Hlahloba ditempele ka hara stack ya hao kgafetsa
Lisebelisoa tse joalo Xygeni thusa lihlopha ho lemoha tšebeliso e sa sireletsehang ea template, ho thibela bofokoli ba SSI, le ho tiisa mekhoa e sireletsehileng ho pholletsa le pipelines le litšekamelo. Ho DevSecOps, ho tšoara SSTI payloads e le kotsi e ka sehloohong ho bohlokoa hobane ente e le 'ngoe feela ho uena pipeline kapa sesebelisoa se ka beha tikoloho ea hau eohle kotsing.
