Skip to content

Exec_Code4.py.md

Latest commit

 

History

History
18 lines (13 loc) · 432 Bytes

Exec_Code4.py.md

File metadata and controls

18 lines (13 loc) · 432 Bytes

Question

What is the problem here?

...
@app.route('/nslookup')
def nslookup():
    domainName = request.args.get("domainName")
    cmd = "nslookup " + domainName
    os.popen(cmd)

-----SPLIT-----

Answer

It is a Code Execution issue. 'domainName' parameter is vulnerable to OS command injection attacks. An intruder can supply 'domainName' and OS command with delimeters (;,|,&, etc) to run consecutive commands.