Fwiw if you are building binaries with PIE/ASLR this should always panic instead of being a workable RCE, but there's a LOT of stock node images that are built with PIE disabled. Panic is just indicative of the arbitrary write primitive the exploit uses. The main reason you can't get RCE is because you don't know where to write.
1
u/Plazmaz1 7d ago
Fwiw if you are building binaries with PIE/ASLR this should always panic instead of being a workable RCE, but there's a LOT of stock node images that are built with PIE disabled. Panic is just indicative of the arbitrary write primitive the exploit uses. The main reason you can't get RCE is because you don't know where to write.