3 ms·
I bet you most bash scripts that don't operate on fixed file names have security vulnerabilities.
by lostmsu 5y ago
I bet you most bash scripts that don't operate on fixed file names have security vulnerabilities.
- hedora 5y agoMost bash scripts aren't setuid root, so this is mostly a moot point.
- JonChesterfield 5y agoNone are, afaik. Linux flatly refused to let me elevate a script to run with root permissions. I ended up porting said script to c++ just so I could have ./gpu_recover work from a test suite which I'm not going to run as root or type passwords into.
- lostmsu 5y agoI don't think local privilege escalation worth worrying in most cases. It is remote code execution that you should beware. A .ZIP archive containing files with funny file names can go a long way in achieving RCE when handled by a shell script without proper input sanitation (which is exactly what I was referring to).