You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Even a space before the dash isn't good enough. The user might have a file called "hello ----dolly.txt" and launching it will pass the command line contoso.exe "hello ----dolly.txt" and since we don't track quotation marks, we think that the space before the dashes is a command line operation separator when in fact it's part of an enclosing file name.
This can be used as a command line injection attack: Create a file called "C:\x ----ms-protocol" with an alternate stream named "attack-you-here .txt". Launching that file will pass the command line "C:\x ----ms-protocol::attack-you-here .txt" which will get mis-parsed as a ms-protocol launch with URL "attack-you-here" (which can be replaced with any desired attack string).
It depends. If the command line is
is the expected parse
a
, data =b"c\"d"e
; ora
, data =bc"de
CommandLineToArgvW will give you version 2.
Also, it seems that a space is not required before the first dash, so we will treat
as
dolly.txt
, data = emptywhich could be surprising if somebody has a file named "hello----dolly.txt".
Originally posted by @oldnewthing in #823 (comment)
The text was updated successfully, but these errors were encountered: