New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remote Code Execution(RCE) via insecure command formatting #2

Open

mohanl0l opened this issue Oct 2, 2020 · 0 comments

mohanl0l commented Oct 2, 2020

It fails to restrict the arbitrary commands in the user input which results in the execution of code(RCE/Information Disclosure/DoS).

aaptjs/index.js

Line 18 in f9fab0b

exec(cmd, (code, stdout, stderr) => {

Raised the same issue in Hackerone as well with POC.:
https://hackerone.com/reports/996483

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment