New post talk about RCE in npm search, and other vulnerabilities in terminal applications.
https://blog.solidsnail.com/posts/npm-esc-seq
https://blog.solidsnail.com/posts/npm-esc-seq
| Blog | https://blog.solidsnail.com |
solid-snail
- 4 Followers
- 27 Following
- 14 Posts
Security Research & Blog
Ars TechnicaBeeper Mini on Android claims to have reverse-engineered iMessage compatibility
Co-founder says it's a security improvement for everyone and should be legal.
This one is a bit different from my previous post.
I basically reported a feature as a vulnerability, not a bug.
https://blog.solidsnail.com/posts/vscode-shell-integ-rce
I basically reported a feature as a vulnerability, not a bug.
https://blog.solidsnail.com/posts/vscode-shell-integ-rce
It’s not a Feature, It’s a Vulnerability
It takes a special kind of person to name a company after their own body part. Fortunately the Microsoft Security Response Center doesn’t seem to have inherited that kind of mentality, because when I have reported not a bug but a feature as a vulnerability - they accepted it.
My first write-up.
Vulnerability I discovered.
Getting RCE from terminal output.
https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce
Vulnerability I discovered.
Getting RCE from terminal output.
https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce
From Terminal Output to Arbitrary Remote Code Execution
It was the year of the Linux desktop 1978. Old yellowed computers were not yet old, nor yellowed. Digital Equipment Corporation released the first popular terminal to support a standardized in-band encoding for control functions, the VT100.