New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

系统信息泄露：内部 #1

Open

QiAnXinCodeSafe opened this issue Jan 15, 2020 · 0 comments

QiAnXinCodeSafe commented Jan 15, 2020

Server_Management_Plugin_Nagios/src/setup.py

Lines 735 to 736 in 0fa3332

    
           PythonPath=sys.executable 
        
           print PythonPath[:-6]

系统数据或调试信息通过打印或日志功能被写入本地文件、屏幕或日志系统，被攻击者查看到，将有助于攻击者了解系统并制定相应的攻击计划。
建议：写错误信息时一定要注意不要将系统信息等直接显示给用户，应该使用简明模糊的信息来提示用户。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment