Re:Do not use secrets in environment variables
by Sohcahtoa82 on Tuesday October 08, 2024 @12:23PM
(#41779056)
As an AppSec engineer and penetration tester...
You'd be scared how often this works (Though not in the exact method you described). It might not even be a path traversal vulnerability [0] that lets you read files, it could be a shell injection [1] that allows you to `cat` the file.
You'd be scared how often this works (Though not in the exact method you described). It might not even be a path traversal vulnerability [0] that lets you read files, it could be a shell injection [1] that allows you to `cat` the file.
[0] https://en.wikipedia.org/wiki/Directory_traversal_attack
[1] https://en.wikipedia.org/wiki/Code_injection#Shell_injection