Exploitation in G minor, or How to Compose an RCE
summary
A security research talk demonstrates achieving remote code execution in the MediaWiki Score extension by abusing its music-notation pipeline: the extension invokes LilyPond with Guile, and Guile permits system calls. The exploit uses the Show Preview feature to run server-side commands, bypasses network restrictions by writing command output to files and reading them back to emulate an interactive shell, and includes proofs such as one-line PHP payloads and base64-uploaded binaries; the issue was responsibly disclosed and the extension disabled.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 4:41Note differences discovery
- 6:25LilyPond basics
- 8:11Scheme language role
- 10:42Scheme pros and cons
- 13:32Scheme syntax basics
- 15:20Geil extension tool
- 16:46First code execution attempts
- 17:51Network access limits
- 18:55System function exploitation
- 21:22Wikipedia vulnerability report
- 22:48Documentation and config issues
- 25:42Four main security problems
- 27:49Insecure security model
- 31:42Old libraries risk
- 34:08Developer takeaways
- 36:59Security researcher takeaways
- 38:21Diverse interests importance
related talks
42m"Vulnerabilities from a grave. Forever dead or maybe alive..."
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
55mHow hacking works
01h 01mHow hacking works - Web edition
01h 06mHow hacking works
36mSecurity - Only Developers Can Make It Proactive
51mHow hacking works - Web edition
53mHow hacking works - Web edition