PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Drag and Pwnd: Leverage ASCII characters to exploit VS Code

portswigger.net | research | #command-injection | #terminal | #vs-code | #control-characters | #node-pty | #ascii
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Control characters like SOH and carriage return, forwarded blindly by node-pty, enable command injection through VS Code run configurations and filenames dropped into terminals on macOS and Ubuntu.
Published
Collected

Related coverage

research · swarm.ptsecurity.com
Cisco Hyperflex: How We Got RCE Through Login Form and Other Findings
An assessment of Cisco HyperFlex HX that found three vulnerabilities: command injection in the installer VM (CVE-2021-1497, CVSS 9.8) and the data platform (CVE-2021-1498), plus a file upload flaw (CVE-2021-1499) — including RCE reached through the login form.
research · swarm.ptsecurity.com
Swarm of Palo Alto PAN-OS vulnerabilities
Analysis of four Palo Alto PAN-OS firewall vulnerabilities: authenticated command injection (CVE-2020-2037, CVE-2020-2038), unauthenticated denial of service (CVE-2020-2039) and reflected XSS (CVE-2020-2036) — each able to leak data, disrupt components or expose internal segments.
research · swarm.ptsecurity.com
Vulnerabilities in Checkpoint ICA Management Tool
Two flaws in Check Point's ICA Management Tool: an argument injection into the cpca process's sendmail invocation, and a shell command injection in the certificate management interface, plus notes on SSL configuration and exposure risks.
research · hackenproof.com
How to Chain Vulnerabilities for RCE: From Image Metadata to Complete System Compromise
A CTF postmortem: five chained flaws — from exiftool metadata revealing wkhtmltopdf, through traversal, SSRF and command injection — produced an unauthenticated CVSS 10.0 RCE in 3h15m.
research · starlabs.sg
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE
Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.
blog · blog.trailofbits.com
Introducing mrva, a terminal-first approach to CodeQL multi-repo variant analysis
mrva is a terminal-first tool for CodeQL multi-repository variant analysis: it downloads pre-built databases via the GitHub API, runs custom queries locally, and prints SARIF results to stdout.
Back