Exploiting SSTI Vulnerability in Messenger Machine on Standoff 365 Leads to RCE and Corporate Chat Access

A comprehensive security analysis published on the Positive Technologies blog details the complete exploitation chain against the Messenger machine hosted on the Standoff 365 platform. The researcher, operating under the handle Seven11eleven, systematically progressed through reconnaissance, vulnerability discovery, and post-exploitation phases while targeting two specific business risks.

Reconnaissance and Initial Discovery

Network scanning with nmap revealed two open web services on ports 80 and 3000. Port 80 hosted the custom Messenger application built with FastAPI, while port 3000 exposed the lightweight Gitness platform for Git repositories and CI/CD pipelines. Directory fuzzing using ffuf uncovered Swagger documentation at /api/openapi.json, providing a full map of API endpoints protected by JWT authentication.

Vulnerability Analysis and SSTI Exploitation

After creating test accounts and exploring the friend system, the researcher identified a User Enumeration issue that revealed valid usernames such as eka.balashova. Adding specific friends unlocked the friendship summary feature, which returned server-rendered HTML instead of JSON. Testing confirmed the presence of Server-Side Template Injection in the Mako template engine. Payloads such as ${7*7} executed successfully, while Jinja2-style syntax did not.

Exploitation progressed to arbitrary code execution using the payload ${self.module.cache.util.os.popen('whoami').read()}. This technique leveraged Mako's internal object references to reach the os module without direct imports, confirming Remote Code Execution on the target system running as user app.

Post-Exploitation and Business Risk Realization

With RCE achieved, the researcher established a reverse shell and began lateral movement. Analysis of the environment revealed connections to RabbitMQ and Redis instances. Custom listeners were developed to intercept messages and extract sensitive data, ultimately fulfilling the business risks of accessing corporate developer chat logs and obtaining the encryption key used by the city messenger application.

The article concludes with practical recommendations for developers using template engines and message brokers, emphasizing input sanitization, least-privilege principles, and network segmentation.