4 ms·
This "vulnerability" requires "able to set an environment variable on a Python execution environment" and "opening a browser leads to RCE". Once you have that l
by neolog 6y ago
This "vulnerability" requires "able to set an environment variable on a Python execution environment" and "opening a browser leads to RCE". Once you have that level of control over a system, I don't think `antigravity` will make or break an RCE.
- pentestercrab 6y agoIt does not require opening a browser, it can cause a browser to open.
- Groxx 6y agoWhich is not on its own a "vulnerability", you'd need to chain it to something usable in the browser / as a consequence of the browser being opened. It increases your options, certainly, but it can't do anything dangerous as-is.
- ragerino 6y agoYou can define any executable in the $BROWSER environment variable which will be executed whenever antigravity is imported. You could execute a 'curl` which directly pipes into 'bash -c'.
- Too 6y ago"Any executable" does not mean adding pipes and arguments. This is one important benefit of not using shell. See https://github.com/python/cpython/blob/master/Lib/webbrowser.py#L174 https://github.com/python/cpython/blob/master/Lib/webbrowser...
- thefreeman 6y agoThis is flat wrong. You can cause it to run an arbitrary binary by setting the BROWSER environment variable, as they demonstrate in the article. They chained it with perl environment variable vulnerability listed earlier to achieve execution.
- Groxx 6y agoYep, I misunderstood then - definitely vulnerable on its own!
- Rebelgecko 6y agoI don't think you need a browser RCE. If you can set environment variables, can't you just change $BROWSER to point towards an arbitrary binary?