Remote code execution in your text editor!
summary
A vulnerability in the Vim Elixir plugin alchemist.vim lets an editor-run server evaluate strings from sockets and read and run local .exs files; a crafted payload written with netcat or sent by a webpage via XMLHttpRequest to localhost can create a file that serves /etc/passwd and return it after adding an Access-Control-Allow-Origin header, enabling remote code execution in practice and triggering a one-week fix.
AI-written summary · about
chapters (3)
related talks
40mMarkDoom: How I Hacked Every Major IDE in 2 Weeks
28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System Takeovers
39mExploitation in G minor, or How to Compose an RCE
56mModern Web Vulnerabilities 2020
01h 01mHow hacking works - Web edition
42mModern web application bugs
53mHow hacking works - Web edition
01h 02meXential XSS (Cross Site Scripting)