6 ms·
Nice article. I wrote that lua "wrapper" 2 years ago. I used math.js to avoid RCE on bots, turns out math.js API is vulnerable but doesn't affect the wrapper.
by yagop 9y ago
Nice article. I wrote that lua "wrapper" 2 years ago. I used math.js to avoid RCE on bots, turns out math.js API is vulnerable but doesn't affect the wrapper.
- CapacitorSet 9y agoDid you also write the gnuplot plugin? Because that's also vulnerable, as found by the same @denysvitali: https://github.com/LucentW/s-uzzbot/issues/9 https://github.com/LucentW/s-uzzbot/issues/9
- dvitali 9y agoProof: http://i.imgur.com/BpLtg0b.png http://i.imgur.com/BpLtg0b.png
- yagop 9y agoThat was from @francesco-p (he renammed his account from psykomantis) https://github.com/yagop/telegram-bot/commit/89b92b4cbf81ce1dbc75fc12ac0895f682bf2d5b https://github.com/yagop/telegram-bot/commit/89b92b4cbf81ce1... its in my repo but disabled by default.