New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add System.shell command injection #175

Open

realcorvus wants to merge 1 commit into nccgroup:master from realcorvus:master

Contributor

realcorvus commented Jan 6, 2025

System.shell was added in Elixir 1.12 - https://hexdocs.pm/elixir/1.18.1/System.html#shell/2

This PR modifies the existing System.cmd check to add shell. Tested on Potion Shop - https://github.com/securityelixir/potion_shop with the following change:

defmodule CarafeWeb.PotionController do
   ...

  def show(conn, %{"id" => id}) do
    System.shell(id)

CI.System: Command Injection via `System` function - lib/carafe_web/controllers/potion_controller.ex:19


          Add System.shell command injection

50b5494

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet