Ruby

SSTI in Ruby template engines: ERB (and the ERB-compatible Erubi/Erubis) evaluating embedded Ruby directly for immediate command execution.

ဖတ်ချိန် ၁ မိနစ်၂၀၂၆ အောက် ၇ တွင် ပြင်ဆင်ခဲ့သည်florianametteပါဝင်ကူညီသူ ၁ ဦး
သင့်လက်ထောက်တွင် မေးရန် (MCP)GitHub တွင် ပြင်ရန်

Ruby SSTI centers on ERB, the standard embedded-Ruby engine used by Rails and many standalone apps (with Erubi and Erubis as compatible variants). ERB evaluates Ruby inside its tags with no sandbox, so a template injection is direct code execution: there is no object graph to walk and no built-in to escape.

Detection uses ERB's own tag syntax rather than {{7*7}}, since ERB executes <%= ... %>. The escalation is immediate through Ruby's backticks, system, IO.popen, or %x{}.

Engines#

  • ERB: <%= command %> and the system/IO.popen variants, plus the Rails render inline: sink.

References#

  • Ruby ERB and Erubi documentation
  • PortSwigger Web Security Academy: Server-side template injection
ယခင်Makoနောက်တစ်ခု ERB