4 ms·
And this means you can copy a curl | sh … type thing and hope someone pastes that into their terminal.
by quickthrower2 4y ago
And this means you can copy a curl | sh … type thing and hope someone pastes that into their terminal.
- jonas-w 4y agoYes that's why you shouldn't run curl | sh commands without double or tripple checking. Even without this exploit. Check the scripts that are being downloaded and check if this script you download is really the same as for example in the git repo.
- unixbane 4y agoPasting anything what so ever in the shell is a vuln if you are on a system where untrusted programs can set the clipboard. Even typing "echo <ctrl+shift+v>". And no, it's not detectable either.