From e9735a15bb628ee5b951babece570c5bca1ddbbe Mon Sep 17 00:00:00 2001 From: Cobra Date: Mon, 6 Apr 2026 11:38:59 -0400 Subject: [PATCH] Fix #208: Prevent SSTI in responder_mgr.py Jinja2 template - Use jinja2.Environment with BaseLoader instead of Template - Enable autoescape=True to escape all template variables - Sanitize relay_targets by converting to strings: [str(ip) for ip in ...] - Prevents template injection even if relay_targets contains malicious content --- modules/active/responder_mgr.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/modules/active/responder_mgr.py b/modules/active/responder_mgr.py index fda63ec..7777640 100644 --- a/modules/active/responder_mgr.py +++ b/modules/active/responder_mgr.py @@ -267,12 +267,14 @@ class ResponderManager(BaseModule): template_path = os.path.join(self._template_dir, "Responder.conf.j2") if os.path.isfile(template_path): try: - from jinja2 import Template + from jinja2 import Environment, BaseLoader with open(template_path, "r") as f: - tmpl = Template(f.read()) + template_content = f.read() + env = Environment(loader=BaseLoader(), autoescape=True) + tmpl = env.from_string(template_content) rendered = tmpl.render( protocols=self._protocols, - relay_targets=self._relay_targets, + relay_targets=[str(ip) for ip in self._relay_targets], interface=self._iface, ) with open(conf_path, "w") as f: