Luarocks.org remote code execution exploit

22 pointsposted 12 hours ago
by cupcakerob

1 Comments

rurban

2 hours ago

Oh oh, unsafe eval in a sandbox! (loadstring).

In my lua-like sandbox I disabled all escape hatches and unsafe functions physically by #ifndef SANDBOX. No IO, no FFI, no byte code loading, no memory funcs and such.