News for hackers. Stuff that matters.

A comment on Remote Code Execution as a Service. Parent comment

Re:Remote Code Execution as a Service by iueotnmunto on Tuesday March 07, 2023 @03:10PM (#35060509)
More if you're running `provision --vm-name "$UserSuppliedData"` or similar. I don't know how you've built your wrapping tool, so I can't comment on how likely it would be, but I've seen such breakages IRL (I break things for a living ;) )
[ Parent | on HN ]
Re:Remote Code Execution as a Service by brandonschurman on Tuesday March 07, 2023 @03:22PM (#35060647)
Good point, we do have things locked down pretty well in our go code though. The instances can only be provisioned using an API, and that API doesn't allow for arbitrary user-supplied input.
[ Parent | on HN ]