3 ms·
If an attacker could control the curl CLI on your SoHo router, couldn't they just direct it to download their evil payload, and then use one of a million more c
by verall 4y ago
If an attacker could control the curl CLI on your SoHo router, couldn't they just direct it to download their evil payload, and then use one of a million more common problems to run the evil? Or directly exfiltrate data through HTTP requests made by curl? I don't think anyone runs curl as root so there is no privilege escalation.
Seriously I can't understand the threat model here.
- woodruffw 4y agoThere are different scopes: it's not the case that every controllable CLI invocation is also one where an attacker could change the URL entirely. There are cases where they might only be able to change the behavior of a single flag or option, or a subrange of characters in a specific protocol's URLs, etc. I think the realistic attack model here is: 1. SoHo router that has a public accessible endpoint that takes inputs boiling down to "safe" cURL flags; 2. Those flags can actually induce memory corruption; 3. An attacker is able to execute arbitrary remote code in the context of the cURL subprocess through a payload packed into the "safe" flag.
- deleted 4y ago[deleted]