Conversation

twitter.com/empijei/status

This Tweet is unavailable.

1

2

You’re unable to view this Tweet because this account owner limits who can view their Tweets. Learn more

Replying to

and

Sounds like a lot of real world cases with scripting in a sandbox.

1

You’re unable to view this Tweet because this account owner limits who can view their Tweets. Learn more

Replying to

and

The scripting doesn't need to be in the Go code to accomplish the same thing, and as I said, that sounds a lot like many commonly deployed environments.

2:17 PM · Nov 7, 2019Twitter Web App

Replying to

and

i.e. it can be JavaScript or Lua scripting closely tied to Go code, such as a web browser, custom map / mod scripting for a game engine, etc. There are a lot of cases where an attacker has scripting capabilities. Remote access to a service can also provide similar capabilities.

2

Replying to

and

It's definitely way harder to do an exploit like this without either direct remote connections to a service or even better local scripting. Still, I'm not really surprised anymore when people exploit something like a 1 byte null overflow without scripting or an active connection.

1