Skip to content

Command injection vulnerability #1

@jamesharr

Description

@jamesharr

FYI - this is likely opening the door for command injection

https://github.com/NSO-developer/nso-sso-duo-integration---native/blob/cli_auth/my-test-auth.sh#L15C1-L15C73

	/bin/bash -c "nohup /usr/sbin/login_duo  -d -f $user &> /tmp/$user.txt"

IE: What happens if an attacker uses a malicious username? IE:

>/dev/null; echo "whatever is needed";

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions