News for hackers. Stuff that matters.

A comment on TrendMicro Node.js HTTP server listening on localhost can execute commands. Parent comment

Re:TrendMicro Node.js HTTP server listening on localhost can... by raverbashing on Monday January 11, 2016 @03:41PM (#10883333)
Really, it's a simple email away from a complete disaster

Send an email to several people on the organization containing the offending JS that calls shell execution, this can have a huge impact.

"Security software" LOL

[ Parent | on HN ]
Re:TrendMicro Node.js HTTP server listening on localhost can... by JoshTriplett on Monday January 11, 2016 @08:09PM (#10884879)
While email can't directly call JavaScript, these URLs look like they'd work if just loaded, so an <img> tag might suffice to cause shell execution.
[ Parent | on HN ]
Re:TrendMicro Node.js HTTP server listening on localhost can... by raverbashing on Tuesday January 12, 2016 @04:51AM (#10886432)
True, and you can always have a "Click here for more info" in the email pointing to a believable page.

But yeah, an image will most likely do it.

[ Parent | on HN ]