Skip to content

No sanity check of input of dhcp option vendor-class #1657

Description

@mattiaswal

Current Behavior

admin@infix-00-00-00:/config/> set interface e1 ipv4 dhcp option vendor-class value `x"\nrun [2345] /bin/sh -c "id>/tmp/pwn"`
admin@infix-00-00-00:/config/> leave 
admin@infix-00-00-00:/> 
admin@infix-00-00-00:/> 
admin@infix-00-00-00:~$ ls /tmp/pwn
/tmp/pwn

This is run as user root

Expected Behavior

YANG validation error i think.

Steps To Reproduce

No response

Additional information

No response

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

Relationships

None yet

Development

No branches or pull requests

Issue actions