3 ms·

Shout out to the RCE I found in the zeit.now deploy button: https://github.com/zpnk/deploy.now/issues/27 https://github.com/zpnk/deploy.now/issues/27 Hopefull

by orf 8y ago

Shout out to the RCE I found in the zeit.now deploy button: https://github.com/zpnk/deploy.now/issues/27 https://github.com/zpnk/deploy.now/issues/27 Hopefully someone from Zeit reading this can get my fix merged, it seems to be quite a popular service

Rauchg 8y ago
This is not supported nor maintained by us. Thanks a lot for bringing it to our attention. We will do our best to reach out!
- orf 8y ago
  Sure, but I reached out nearly a year ago to the maintainers with no reply. It seems anyone can now execute anything on your infrastructure (for free!), which isn't great.
  - simonw 8y ago
    That's the case already: anyone can sign up for a free Zeit account and deploy code (wrapped in a Docker container) that then executes on Zeit's infrastructure.
    - orf 8y ago
      And now someone can do it without signing up, using someone else's account, possobly disabling a widely used and quite cool service.