.. /p4.exe

Star

Vendors:

• Perfoce for Windows

Code Execution

1. You are able to inject an environment variable to execute arbitrary commands.

   subprocess.run(['p4.exe', 'set', 'P4_USER=user＂ ＂P4EDITOR=calc.exe'])

   Use case

   If certain parts of the argument(s) are controllable, the attacker can inject additional arguments.

   Code Pages

   125x, 874

Acknowledgements:

• DEVCORE Research Team (@d3vc0r3)