SSTI to RCE

A Flask application uses Jinja2 templates unsafely. Exploit SSTI to read /etc/flag.

Vulnerable Code

@app.route('/hello')
def hello():
    name = request.args.get('name', 'World')
    template = f"Hello {name}!"
    return render_template_string(template)

Test

/hello?name={{7*7}} returns "Hello 49!"

Craft a payload to read the flag file.