4 ms·
Nice work and writeup. All stemming from very basic mistakes -- SQL and command injection. Worrying that the CloudSQL internals (like the private IP range) ar
by gwittel 6y ago
Nice work and writeup. All stemming from very basic mistakes -- SQL and command injection.
Worrying that the CloudSQL internals (like the private IP range) aren't strongly walled off. It will be interesting to see how this changes in response to the researchers' work.
- trhway 6y agolooks like a shortcut: > the container was configured with the Docker host networking driver (–network=host).
- pabs3 6y agoArgument injection rather than command injection, but yes. The canonical document on argument injection is here btw: https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt https://www.defensecode.com/public/DefenseCode_Unix_WildCard...