4 ms·
Related: Someone Knows Bash Far Too Well, And We Love It (Ivanti EPMM Pre-Auth RCEs CVE-2026-1281 & CVE-2026-1340) https://labs.watchtowr.com/someone-knows-bash
by chillax 8mo ago
Related: Someone Knows Bash Far Too Well, And We Love It (Ivanti EPMM Pre-Auth RCEs CVE-2026-1281 & CVE-2026-1340) https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/ https://labs.watchtowr.com/someone-knows-bash-far-too-well-a...
- ddtaylor 8mo agoI think there is an easier substitution attack since there is shell expansion occuring. I will toy with it later today.
- PhilipRoman 8mo agoThe array indexing thing is a special case in [[...]] which is otherwise more-or-less secure (no expansion occurs under typical unquoted variable access). https://news.ycombinator.com/item?id=46631811 https://news.ycombinator.com/item?id=46631811
- faresfa 8mo ago[dead]