RCE Gadgets
RCE gadgets cause the victim process to execute attacker-provided code. The attacker writes a string at a runtime location whose value the application’s own code later passes to subprocess, an import hook, or a shell.
Standard library
| Library |
Trigger |
Polluted property |
webbrowser |
webbrowser.open |
os.environ['BROWSER'] |
antigravity |
import antigravity (calls webbrowser.open on import) |
os.environ['BROWSER'] |
subprocess |
subprocess.run(..., shell=True) |
os.environ['COMSPEC'] |
Third-party packages
| Library |
Trigger |
Polluted property |
taipy.gui |
- |
Gui.__SELF_VAR |
Real-world cases