Bug Bounty Hunting Essentials

Twig and FreeMaker

Twig and FreeMaker are template engines developed in Python. In the first line, the template is waiting for a name, which is displayed. There is no problem here:

$output = $twig->render("Dear {first_name},", array("first_name" => $user.first_name) );

But now, in the following line, which is part of the same code, the template's waiting for an email in order to personalize it to display the content:

$output = $twig->render($_GET['custom_email'],  array("first_name" => $user.first_name) );

As shown in the preceding code snippet, the template is vulnerable because it's open to receive any kind of data entered by the user, and the user can inject a formatted email or a bunch of code that modifies the user's display.

But this ...