Security

522 readers

5 users here now

A community for discussion about cybersecurity, hacking, cybersecurity news, exploits, bounties etc.

Rules :

All instance-wide rules apply.
Keep it totally legal.
Remember the human, be civil.
Be helpful, don't be rude.

Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient

founded 1 year ago

MODERATORS

LinearArray@programming.dev

BatBadBut: You can't securely execute commands on Windows (flatt.tech)

submitted 7 months ago by testeronious@lemmy.world to c/security@programming.dev

15 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] arendjr@programming.dev 3 points 7 months ago

take in user sourced input without any sanitization

But that’s exactly the problem: these applications were sanitizing the input using the APIs provided by their language standard libraries. Except that sanitization proved insufficient because the requirements for sanitization differ greatly when the command is interpreted by cmd.exe as opposed to running regular executables. This is such a big footgun in the Windows API that it was overlooked by seemingly every major programming language implementation out there.