News for hackers. Stuff that matters.

A comment on TrendMicro Node.js HTTP server listening on localhost can execute commands. Parent comment

Re:TrendMicro Node.js HTTP server listening on localhost can... by sangnoir on Tuesday January 12, 2016 @05:28AM (#10886543)
> The problem is that JS is really easy to make mistakes in because of silent errors, dynamic typing, type coercion, etc.

All those are not a factor in this instance. It seems to me it's a result of calling exec() on unscrubbed user input, and this can be done in any language.

[ Parent | on HN ]
Re:TrendMicro Node.js HTTP server listening on localhost can... by smt88 on Tuesday January 12, 2016 @09:34AM (#10887588)
I agree. I was responding to a tangential comment, rather than the root post.
[ Parent | on HN ]