search

FabModules / fabmodules-html5

Fork of HTML5 Fab Modules by Neil Gershenfeld
Other
61 stars 74 forks source link

Client-server communication is insecure #22

Open jonnor opened 8 years ago

jonnor commented 8 years ago

The server will happily execute arbitrary commands sent by the client. Just type in rm -rf foo and it will be ran.

There is some 'mitigration' in that the Websocket server will only accept connections from the same IP address. However, it is impossible to safely expose fabmodules over a network, which is one of the major benefits of a web-based system.

Proposed is to only execute a known subset of commands (enforced by server), not arbitrary stuff.

fibasile commented 8 years ago

This is true, I think limiting access to a specific set of commands (in the same folder as mod_server) would be enough.