im3x Scriptables filename handling flaw allows OS command execution
Developer helper tool for iPhone apps can be hacked through filenames!
Summary
Sending a specially crafted filename to the /sync endpoint of the im3x Scriptables development server lets an attacker run commands on the server computer. The default setup, which is reachable over the network without authentication, is affected.
Affected when
- Default setup binds to all network interfaces (0.0.0.0:5566)
- No authentication
What to do
No fixed version is named in the sources. Keep the development server from being reachable from outside networks, check that the program is newer than v2-dev, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen