-
Notifications
You must be signed in to change notification settings - Fork 222
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Is it safe to use eval on user input? #969
Comments
Gargoyle is a single user system. You must have already broken the root password to be able to run any page that does this. I get it, but I think the attack vector is kind of moot here. |
Further, haserl filters these variables into the environment. So if there's a vulnerability it likely exists at that level. I recently tested this after an issue was raised against the diagnostics plug-in |
|
did You tried to inject both url encoded (full encoding and not full) data? |
I'll run some further validations. |
Thank You, |
Gargoyle router is no longer in my possession. But this part of code catch my eyes |
I was not able to produce any RCE type issues with this code. From my point of view, this issue should now be closed, and if in the future yourself (or anyone else) is able to produce some kind of vulnerability of this nature, please do let me know! Thanks for raising the issue! |
@weakbytes please close this issue |
Closed |
Almost all utility scripts contains following or similar:
Consider this:
Let's assume:
HTTP_USER_AGENT='$(ls > log.txt;sleep 30)'
Then this is safe as nothing gets executed:
echo $HTTP_USER_AGENT
echo "$HTTP_USER_AGENT"
But this is does gets executed:
eval $(echo "$HTTP_USER_AGENT")
Do we have here potential RCE vulnerability using $POST_hash" "$COOKIE_exp" "$HTTP_USER_AGENT" "$COOKIE_browser_time"?
The text was updated successfully, but these errors were encountered: