CVEs-PoC/2014/CVE-2014-7817.md

CVE-2014-7817

Description

The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((...))".

POC

Reference

• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Github

No PoCs found on GitHub currently.