# H1514 Server Side Template Injection in Return Magic email templates?

Shopify Return Magic email templates rendered user input through Handlebars, letting an attacker inject template expressions and reach server-side RCE.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2019-04-04
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/423541
- Library page: https://bugbountylibrary.com/r/h1%3A423541
- Tags: area:web domain:web impact:internal-access impact:rce kind:bounty platform:hackerone sev:high tech:nodejs technique:source-review vuln:rce vuln:ssti

**Target:** Return Magic app email/workflow template editor (Node.js backend)
**Root cause:** User-controlled email template content is compiled and rendered server-side by a Handlebars engine without sandboxing, so template expressions like `{{this}}` are evaluated against backend objects.
**Steps:**
1. Install Return Magic app
2. Navigate to `https://<shop>.myshopify.com/admin/apps/returnmagic`
3. Open Settings tab, then Emails --> Workflow from left menu
4. Click Edit for any email template, click the code icon, enter `{{this}}`
5. Go back to Workflow page, click Send me a test email, enter your email
6. Check inbox: `[Object Object]` confirms template evaluation; `{{ this.__proto__.constructor.name }}` returns `Object`
**How found:** Researcher was experimenting with Return Magic workflow email templates, injected `{{ this }}` and observed `[Object Object]` in the delivered email, then probed `__proto__` and constructor to confirm a Node.js template engine was evaluating input.
**Exploitation:** Attacker edits a workflow email template with Handlebars expressions and triggers rendering via 'Send me a test email'; expressions evaluate server-side, and per the linked write-up escalate to RCE via Handlebars gadget chains.
**Escalation:** From object introspection (`{{this}}`, `__proto__`) to full Handlebars SSTI RCE as documented in the researcher's blog post.
**Insight:** Email/workflow template editors that render via Handlebars are prime SSTI targets; a simple `{{this}}` in a test-send flow reveals object introspection, and `__proto__.constructor.name` fingerprints Node.js for gadget-chain escalation.

## Proof of concept (copied exactly from the original report)

**Handlebars template injection payloads in email template**

```
`{{ this }} ` -> `[Object Object]` 
`{{ this.__proto__ }}` --> `[Object Object]`
`{{ this.__proto__.constructor.name }}` --> `Object`
```