Skip to content

fix: false positive success message in iam__privesc_scan#506

Open
raajheshkannaa wants to merge 1 commit intoRhinoSecurityLabs:masterfrom
raajheshkannaa:fix/privesc-scan-false-success
Open

fix: false positive success message in iam__privesc_scan#506
raajheshkannaa wants to merge 1 commit intoRhinoSecurityLabs:masterfrom
raajheshkannaa:fix/privesc-scan-false-success

Conversation

@raajheshkannaa
Copy link

Closes #483

iam__privesc_scan reports "Privilege escalation was successful" even
when every method fails. The check if response is False uses identity
comparison, so if an escalation method returns None (e.g. falling through
a try/except without an explicit return), None is False evaluates to
False and the code treats it as a success.

Fix: change if response is False to if not response so that None,
False, and any other falsy return value is correctly treated as failure.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

iam__privsec_scan escalation success message

1 participant