Mozilla VPN Clients: RCE via file write and path traversal
该报告还没有中文解读。
原文摘录
摘自原文（2886 字符中的一小部分）
Summary: Hi! I decided to have another look at the Mozilla VPN Client, after #2920675 was set to resolved. When going over all commands in the inspector, I noticed the "live_reload" command can be used with remote files. When using this command, the remote file is downloaded to a tmp folder. The …
原文中的代码
QObject::connect(
request, &NetworkRequest::requestCompleted,
[this, path, dummy_task](const QByteArray& data) {
dummy_task->deleteLater();
auto temp_path = QString("%1/%2").arg(m_qml_folder, path.fileName());
auto temp_file = new QFile(temp_path); …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Mozilla 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @trein · 版权归作者与 Mozilla 所有