EmailShell - A War Story on leveraging Server Side Template Injection (SSTI) to hack into GCP

No ratings

Presented at BSides London 2025 by

Filip

Join us on a demonstration of a TWIG language Server-Side Template Injection (SSTI) vulnerability identified and successfully exploited in a real, client engagement. Through the vulnerability we obtained command execution with command output landing in our email inbox, leading to a reverse shell and subsequently pivoted into the client Google Cloud Platform (GCP) cloud environment by leveraging application credentials once foothold has been established. Beyond the interesting war story, we will explore ways to go about looking for different SSTI vulnerabilities, how to discover attack surfaces for different templating engines and how to safely exploit these, showcase pivoting opportunities into cloud environments such as GCP to showcase customer impact and handle client communications.