Jump to content

Arbitary binary execution vurnability


Ricoom
  • Fixed
file = GLOBAL.io.open("../bin/dontstarve_dedicated_server_nullrenderer.exe", "w")

                    -- sets the default output file as test.lua
                    GLOBAL.io.output(file)

                    -- appends a word test to the last line of the file
                    GLOBAL.io.write("-- End of the test.lua file")

                    -- closes the open file
                    GLOBAL.io.close(file)

 

is possible and will override the exe file .. now if instead of text you would insert something more nefarious and executable there you could possibly get somebody to execute anything. Very dangerous. Video below at 14.00 mark will illustrate better what I mean

 


Steps to Reproduce
use lua code in post



User Feedback


A developer has marked this issue as fixed. This means that the issue has been addressed in the current development build and will likely be in the next update.


Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×
  • Create New...