-
Notifications
You must be signed in to change notification settings - Fork 8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Ability to Detect RCE Attacks Via Backticks #36
Comments
Hi @cp1992! This is a great question! At the moment, ZARN looks just for "risks functions" and then checks if some payload can be used to perform an attack. So, in the current structure we cannot create any rules for this use case of Backticks =/ (I'm trying to put more functionality into ZARN and will consider this use case.) I don't know much about Perl::Critic but it also has some security checks, is it covered for this case? |
@htrgouvea Perl::Critic was not able to flag this issue either, in fact it misses many of the issues your tool identifies. If this is something that could be considered for addition that would be awesome! Your tool is very useful and your efforts much appreciated. |
Thank you @cp1992! Any other suggestions you have, feel free to open more issues or pull requests. Features or ideas for new rules are always welcome. |
Problem: Currently the default ruleset includes many of the common keywords/commands that can be used to trigger an RCE attack, e.g.
system
,eval
,exec
, andqx
. However, it does not provide a solution for executing a system command using the backtick syntax, e.g.Is there a way to write a rule or add functionality to allow for zarn to identify and flag this kind of code?
The text was updated successfully, but these errors were encountered: