Comments (6)
walterking
commented on May 18, 2024
I verified this, if you do arp -s 169.254.169.254 <victim mac address> then you can just curl the metadata address and steal credentials as long as you are on the same network(ie, coffee shop).
from hologram.
dialtone
commented on May 18, 2024
this is how they fixed it.
from hologram.
copumpkin
commented on May 18, 2024
Ouch, this seems pretty bad. Can we steal that remote address check for hologram?
… On May 31, 2018, at 17:45, Valentino Volonghi ***@***.***> wrote:
***@***.***
this is how they fixed it.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.
from hologram.
dialtone
commented on May 18, 2024
Yeah, should be pretty easy to do
from hologram.
dialtone
commented on May 18, 2024
#97 This should do it.
from hologram.
BillMedernach
commented on May 18, 2024
Tested this with the latest version of Hologram and this vulnerability is fixed.
from hologram.
Related Issues (20)
- Support for WSL? HOT 1
- Consider ECS Task role support
- Install is broken HOT 1
- mTLS support would be nice
- M1 chip support
- Receiving panic when trying to run hologram-agent in a Kubernetes pod
- No ability to easily open AWS console using hologram credentials HOT 5
- Provide better error message when hologram-agent is not running HOT 1
- hologram-ping can not connect to hologram-server
- Insecure default connection to hologram server? HOT 3
- Occasional DNS lookup failures when calling hologram agent HOT 5
- Go 1.4 builds as specified in the Dockerfile fail on macOS Sierra HOT 3
- Sierra issues HOT 3
- The hologram roles feature doesn't work with AD servers HOT 1
- hologram-boot process uses 60%+ CPU on macOS Sierra HOT 6
- Error reading data from stream HOT 6
- Support for iam/info endpoint? HOT 1
- gpg-agent managed SSH_AUTH_SOCK encounters signing error HOT 1
- Not able to getHologram working because userPassword field does not exist in the LDAP user entry.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from hologram.