Brendan Dolan-Gavitt @moyix.net · Nov 14 The Scoold developers were super responsive and published a fix quickly once we reported the issue! From the patch we can see what the root cause was – using an API that doesn't normalize paths when performing the access check: github.com/Erudika/scoo...
1 likes 1 replies
?
Replies
Many more fun moments to be found in the full trace – one funny bit is that due to the description of the app we provided ("Stack Overflow in a JAR", taken from its DockerHub page), it thought it should try to exploit a stack overflow in the config parser: xbow.com#dockerhub-sr...