Skip to content

Commit 0a1eea9

Browse files
committed
Allow local_editor in cmd_edit to take arguments
Such as vim -i NONE. This may allow command injection via arguments. However, you can already start an arbitrary program by setting LocalEditor or escaping the editor. msf > setg LocalEditor /bin/sh LocalEditor => /bin/sh msf > edit -i [*] Launching /bin/sh -i $
1 parent 234ef56 commit 0a1eea9

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

lib/msf/ui/console/command_dispatcher/modules.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ def cmd_edit(*args)
9292
end
9393

9494
print_status("Launching #{editor} #{path}")
95-
system(editor, path)
95+
system(*editor.split, path)
9696

9797
# XXX: This will try to reload *any* .rb and break on modules
9898
if args.length > 0 && path.end_with?('.rb')

0 commit comments

Comments
 (0)