TrendMicro Node.js HTTP server listening on localhost can execute commands

Re:TrendMicro Node.js HTTP server listening on localhost can... by JoshTriplett on Monday January 11, 2016 @08:09PM (#10884879)

While email can't directly call JavaScript, these URLs look like they'd work if just loaded, so an <img> tag might suffice to cause shell execution.

[ Parent | on HN ]

Re:TrendMicro Node.js HTTP server listening on localhost can... by raverbashing on Tuesday January 12, 2016 @04:51AM (#10886432)

True, and you can always have a "Click here for more info" in the email pointing to a believable page.

But yeah, an image will most likely do it.

[ Parent | on HN ]