TIL that on windows, cmd.exe /c implements a CVE for you by default, by automagically interpreting any passed *command line* as a *filename with spaces*. You need to pass /s to turn off the free CVE. So cmd /c "ping http://evil.com/../../../../../../windows/calc.exe" pops calc.
-
-
Were they trying to maintain bug-compatibility?
-
According to the wine source, this is actually "new behavior" somehow. I wonder when it was introduced...
- Show replies
New conversation -
-
-
That's... quite odd
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
To be fair this is the kind of stuff that happens when you need to support legacy syntaxes going all the way back to CP/M *and* you also get complaints from developers in big budget companies that "your OS doesn't work" because they used it wrong.
-
By the way I'm trying to be fair to the poor soul who was stuck coding this nightmare, not the company.
End of conversation
New conversation -
-
-
Well, to be *perfectly* fair, quotes around the command line aren't required, so I think it's assuming you meant this [which also opens calc]. Still, being able to do it with a nonexistent path is a bit shocking. And it goes against how most programs process arguments.pic.twitter.com/19mEFrPpYC
-
But it's inconsistent. You can put quotes around a command line with space separated arguments and it'll interpret it as a command line, if an executable of the same name as the whole doesn't exist. Its different from how the normal interactive parsing works.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.