Comments (10)
Further, haserl filters these variables into the environment. So if there's a vulnerability it likely exists at that level. I recently tested this after an issue was raised against the diagnostics plug-in
from gargoyle.
Gargoyle is a single user system. You must have already broken the root password to be able to run any page that does this.
If you've got root, you've got an easier attack route than this.
I get it, but I think the attack vector is kind of moot here.
Do you agree? I'm happy to hear you out.
from gargoyle.
- Thanks You for fast reply.
- Sometimes run_commands and/or get_password_cookie are running before login succeeds.
- it seems safe as long as gargoyle_session_validator does not "print" the user-input, otherwise it gets executed, 'echo' do prints.
- haserl even can translate from url encoded values giving more "obfuscation" to user-payload.
from gargoyle.
Further, haserl filters these variables into the environment. So if there's a vulnerability it likely exists at that level. I recently tested this after an issue was raised against the diagnostics plug-in
did You tried to inject both url encoded (full encoding and not full) data?
from gargoyle.
I'll run some further validations.
If you have a proof of concept vulnerability that you believe works, feel free to send it to me privately via the forum or you can email me. That way any potential vulnerability is disclosed privately and can be fixed before details are released.
from gargoyle.
I'll run some further validations. If you have a proof of concept vulnerability that you believe works, feel free to send it to me privately via the forum or you can email me. That way any potential vulnerability is disclosed privately and can be fixed before details are released.
Thank You,
from gargoyle.
Gargoyle router is no longer in my possession. But this part of code catch my eyes
from gargoyle.
I was not able to produce any RCE type issues with this code.
IF a line existed like eval $(echo "$HTTP_USER_AGENT")
then yes it is very easy to trigger lots of unwanted behaviour.
However passing it into the gargoyle_session_validator appears to do no harm, and I was not able to come up with any syntax that would escape out of this subshell and execute anything meaningful.
From my point of view, this issue should now be closed, and if in the future yourself (or anyone else) is able to produce some kind of vulnerability of this nature, please do let me know! Thanks for raising the issue!
from gargoyle.
@weakbytes please close this issue
from gargoyle.
Closed
from gargoyle.
Related Issues (20)
- WNDR4300 WAN port is limited to 100Mb HOT 6
- Enable TP-Link TL-WR710N for Gargoyle 1.14 or later HOT 5
- Wake on lan problem HOT 5
- RFC: Replace IMQ with IFB for QoS/Quotas HOT 3
- Gargoyle 1.13.0.2 (b69041f8) firewall restriction rule not working HOT 4
- Any way to keep the window size after closing the Software? HOT 2
- Saving IPv6 suffix in DHCP HOT 1
- where did arpnat goes? HOT 3
- [devel][plugin-gargoyle-diagnostics] Bug... HOT 3
- Status of 22.03 release HOT 17
- [1.13/1.15] Error adding ftp users with the same permission HOT 4
- x86 ,only one lan port?one wan port? HOT 4
- Misconversion of units in other languages HOT 4
- Gargoyle v1.14.0 factory.bin image TFTP flash to TL-WR1043ND v1.0 results in bootloop HOT 4
- Gargoyle 1.4 - qutoas others (individual ) dont work HOT 5
- [New Feature] Add IP2Location.io API in gipquery.c HOT 8
- Problem with Quotas in 1.14 HOT 5
- Temat: Garygole 1.14.0.2 (Built 20231226-1035 git@8e210b77) Cudy x6 v2 Firewall -> transfer limit HOT 4
- Can't Access USB FTP Storage via Wireguard HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gargoyle.