3 ms·
And thanks to the magic of "shoving strings from the Internet into a command line", poof, RCE! It bit GitLab twice
by mdaniel 2y ago
And thanks to the magic of "shoving strings from the Internet into a command line", poof, RCE! It bit GitLab twice
- xrisk 2y agoWhat incident are you referring to?
- mdaniel 2y agohttps://gitlab.com/gitlab-org/gitlab/-/issues/327121 https://gitlab.com/gitlab-org/gitlab/-/issues/327121 is the first one, and I'm having trouble locating up the second (possibly due to the search pollution from the first one) but there are a bunch of "Exiftool has been updated to version [0-9.]+ in order to mitigate security issues" style lines in their security releases feed so it's possible they were bitten by upstream Exiftool CVEs Anyway, turns out that shelling out to an external binary fed with bytes from the Internet is good fun