4 ms·

cat "$filename" ... Oh dear. Ohdearohdearohdear. Now all we need to do is make sure that the first character in $filename is "&" followed by some privilege e

by cstross 16y ago

cat "$filename" ... Oh dear. Ohdearohdearohdear. Now all we need to do is make sure that the first character in $filename is "&" followed by some privilege escalation exploit and ... (Am I missing something?)

rix0r 16y ago
Well the variable expansion is quoted, so afaik it could only be interpreted as a single argument to cat.
- Erwin 16y ago
  The double quote quoting, while allowing you to do e.g. rm "file with spaces" still expands $ and `. Compare: echo none:`date` echo double: "`date`" echo single: '`date`'
  - js2 16y ago
    But it doesn't expand recursively, so "$var" is safe to protect against special characters in var. That said, one should really read one's shell's documentation, because there be dragons.
msbarnett 16y ago
Nothing about this is intended to be the least bit secure. It's a fun hack, nothing more.
sjs 16y ago
Not saying there isn't an exploit here, but that's not it. % foo="& do_evil" % cat "$foo" cat: & do_evil: No such file or directory Now if the request was for the path /../../../../../../etc/passwd ... that's a different story. edit: and with the CGI stuff it might be possible to execute rm or something else dangerous/destructive.