Second Order Injection - Terminal Breakout

What is Second Order Injection? In some cases the attackers are able to store their malicious code into a storage area of a web application that may be executed at later time or date. Some smart "hackers" change the Browsers "User Agent" into a Cross Site Scripting pattern and when the log is analyzed at later time, a successful cross site scripting exploitation could be executed.

This is all known - but one could insert special characters that have a special meaning in your shell (bash/csh/ksh/..) to exploit a "grep" or "tail" command once the log is analyzed manually with a terminal.

The authors name it as "log escape sequence injection". A large list of web application servers are vulnerable! (not Apache)

Please review the alert message from the authors.

Have a safe day

Ivan