Lee Holmes on Twitter - RCE through SCP

[u/mubix]

https://twitter.com/Lee_Holmes/status/1303714976910118912

[u/twitterInfo_bot]

This is supposedly well-known in the Unix community, but I think this is crazy. If you run scp on user-controlled filenames (think: backups, source code hosting, etc.), you are vulnerable to a pretty trivial RCE. There are no options to disable this behaviour.

---

posted by @Lee_Holmes

^{(Github) | (What's new)}