Skip to content

x/website: RCE Playground #39404

Closed
Closed
@Jaume-Vendrell

Description

@Jaume-Vendrell

Hello,

After playing for a while with the go playground in the main site, I found out that I can easily remote execute code in the server. This should be fixed as soon as possible as anyone could potentially take over the server.

The code that I have used is:

package main

import (
"fmt"
"os/exec"
)

func main() {
Command := fmt.Sprintf("uname -a")
output, err := exec.Command("/bin/sh", "-c", Command).Output()
fmt.Print(string(output))
fmt.Print(err)
}

And the results is: RCE - Go

Regards,

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions