Code Execution :: OS Command Injection #1


Problem Statement

The mutation importPaste allows escaping from the parameters and introduce a UNIX command by chaining commands. The GraphQL resolver does not sufficiently validate the input, and passes it directly into cURL.

Resources
Exploitation Solution