pentester.land· May 6, 2022· by Sean Yeoh (@seanyeoh), James Hebden (@devec0)

Cloudflare Pages, part 1: The fellowship of the secret

Target Program: Cloudflare

🎯 Vulnerability: Remote Code Execution (RCE)

💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.

#Command injection#Container escape#Bash Path injection#RCE#Local Privilege Escalation#Information disclosure