# uber.com may RCE by Flask Jinja2 Template Injection

Profile name on rider.uber.com was rendered through Jinja2 in the account-update email, so SSTI payloads executed server-side, enabling code injection toward RCE.

- Payout: $10,000
- Severity: high
- Program: Uber
- Credited: orange
- Disclosed: 2016-04-06
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/125980
- Library page: https://bugbountylibrary.com/r/h1%3A125980
- Tags: domain:web impact:rce kind:bounty platform:hackerone sev:high tech:python technique:source-review vuln:rce vuln:ssti

**Target:** rider.uber.com profile name rendered in transactional email template
**Root cause:** User-controlled profile name was concatenated into a Jinja2 template rendered server-side when generating the account-update email, instead of being passed as a context variable.
**Steps:**
1. Set profile name to `{{ '7'*7 }}` on rider.uber.com.
2. Trigger the 'Your Uber account information has been updated' email to support@uber.com.
3. Observe name rendered as `7777777` in the email body, confirming Jinja2 evaluation.
4. Escalate with `{{ [].__class__.__base__.__subclasses__() }}` or `{{''.__class__.mro()[1].__subclasses__()}}` to enumerate classes.
5. Use `{%for c in [1,2,3] %}{{c,c,c}}{% endfor %}` to confirm block syntax execution.
**How found:** Researcher hypothesized that user-controlled fields rendered into emails might be templated, and tested a `{{ '7'*7 }}` arithmetic payload in the profile name, observing `7777777` in the resulting email.
**Exploitation:** Attacker controls profile name; when the notification email is generated, the name is evaluated as a Jinja2 template, allowing Python expression execution in the mail-rendering context. Full RCE was constrained by a length limit on the name field.
**Escalation:** Attempted to chain class enumeration (`__subclasses__`) toward arbitrary Python execution, but field length limited payload size.
**Insight:** Email-generating endpoints are a high-yield SSTI surface: test arithmetic payloads in profile/username fields that appear in transactional mail, and use `{{7*'7'}}` (7777777) vs `{{7*7}}` (49) to fingerprint Jinja2 vs Twig.