4 ms·
Step 1 is a crazy vulnerability on its own. How did Apple not consider this? > The attacker can exploit this to conduct a successful directory traversal attack
by paperplatter 2y ago
Step 1 is a crazy vulnerability on its own. How did Apple not consider this?
> The attacker can exploit this to conduct a successful directory traversal attack by setting an arbitrary path to a file in the ATTACH section with: “FILENAME=../../../PoC.txt”.
- btown 2y agoI think this speaks to a larger problem that likely exists in every company: certainly someone at Apple had written a library function to do this safely, but how do you enforce that that function is used, rather than reimplemented unsafely from scratch? Especially if code reviewers are also unfamiliar with the library. Are there any modern solutions for this?
- 1oooqooq 2y agoEasy, by not firing people left and right.
- tikkabhuna 2y agoStatic code analysis tools that can flag for the use of the insecure function?
- paperplatter 2y agoThere's probably a library function that's so annoying to call that people don't bother. Like you gotta first convert the NSString to an NSPath, acquire your library path using some singleton, then construct NSFileHandle (don't take literally, I haven't used objc/swift in ages). Edit: and there are actually 4 library functions with subtly different behaviors