yannvon/grass

Command injection in ping

Closed this issue · 1 comments

After running make, launch the server with ./bin/server.

Then launch the client with ./bin/client 127.0.0.1 1337 and feed it with

ping stuff;xcalc

which pops a calc on the server side.
Indeed at this line https://github.com/yannvon/grass/blob/master/src/commands.cpp#L348 the user input is not escaped.

You are correct, there is indeed a vulnerability in the ping command and we certifiy that your exploit works. 🥇

This is a duplicate issue as #3