uutils / uutils/uutils.github.io
security: malicious commands can exhaust resources of the host os
Nobody has claimed this yet.
- Dominant language
- CSS
- Stars
- 18
- Forks
- 11
- Avg merge
- 3h
- Merged PRs (30d)
- 8
Description
Hi, @sylvestre and in general uutils mainteners
we found that the playground have 2 flaws that lead to resource exhaustation, example https://uutils.org/playground/?cmd=seq%201%209999999999999999999 and https://uutils.org/playground/?cmd=truncate%20--size%2020G%20a can exhaust the host memory and killing the browser process via OOM as i confirmed via firefox
the malicious commands is truncate --size 20G a and seq 1 9999999999999999999 they able kill the browser process entirely
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the playground URL and reproduce the two commands shown: seq 1 9999999999999999999 and truncate --size 20G a. Trace how playground commands are executed and constrained; done means these inputs no longer exhaust host memory or kill the browser process.
Written by the indexing model from the issue text.
Assessment
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100