3 ms·

What's the gaping security hole there? My interpretation of the documentation is that -e PROG execs PROG with stdin/stdout set to the accepted socket. (I mean,

What's the gaping security hole there? My interpretation of the documentation is that -e PROG execs PROG with stdin/stdout set to the accepted socket. (I mean, it's possible to write a program that, if it receives any input on stdin, would rm -rf everything. But the error seems with the combination of the program and -e, and not -e? That is, -e isn't inherently dangerous? Or do we just not trust ourselves that much?)

cyphar 7y ago
-DGAPING_SECURITY_HOLE is how you have to compile nc in order to enable "-e" support. The gaping security hole is that it is literally RCE-as-a-feature -- yes, it's not as bad as "pass any text you get over this socket to a shell session" but it's still pretty bad.
- FDSGSG 7y ago
  There is no security hole, -e isn't pretty bad.
  - Bjartr 7y ago
    He's not being facetious by saying -DGAPING_SECURITY_HOLE, that is literally the flag you need to set when compiling nc to use the -e flag. https://android.googlesource.com/platform/external/netcat/+/refs/tags/android-2.2.3_r1/netcat.c#570 https://android.googlesource.com/platform/external/netcat/+/...
    - FDSGSG 7y ago
      I know that's the flag you need to set, but despite the name setting the flag does not introduce any kind of a security hole.