Hacker News Reader

Comment by mkesper | Hacker News Reader

When you control environment variables, can't you also LDPRELOAD scary stuff?

The second sentence of the blog post states:

   We were also unable to control the contents of a file on disk, and bruteforcing process identifiers (PIDs) and file descriptors found no interesting results, eliminating remote LD_PRELOAD exploitation.

Oops, have overseen that one.

Or just set $PATH to a directory you control containing an "ls" binary. I don't understand what this post is on about at all - is it implying they've discovered a way to control environment variables of unrelated processes or users?

> On a recent project we gained the ability to specify environment variables

> We were also unable to control the contents of a file on disk

From the first and second sentence.

That's my point. What "recent project"? Is there a CVE?

Elttam are a security firm who offer (among other things) pentesting - so they would usually be working privately with, say, a client's website.

One wouldn't usually file a CVE in these circumstances, if only the client is affected.

Reply on news.ycombinator.com