3 ms·
You don't even need to run something untrusted, just compromised console output is enough (from server logs, for example they mention python -m http.server)
by gsuuon 3y ago
You don't even need to run something untrusted, just compromised console output is enough (from server logs, for example they mention python -m http.server)
- ElectricalUnion 3y agoYes, and it's "even better" that your average RCE because it's not running code on the potentially sandboxed server, but on the (statistically speaking not sandboxed) developer/admin machine with potentially privileged access to other machines and systems.