ioredis icon indicating copy to clipboard operation
ioredis copied to clipboard

SHA1 Collision Vulnerability in Lua Script Identification Leads to Potential Security Breach

Open cryptochecktool opened this issue 1 year ago • 0 comments

The method of using hash: Use SHA1 to locate unique identifiers for Lua scripts.

Possible exploitation method: Construct two different Lua scripts, A and B, with the same hash value. Script A is benign, while script B is malicious. After script A passes the review and becomes part of the execution plan, uploading script B will cause script B to regain the identifier of script A, resulting in a takeover.

cryptochecktool avatar Oct 31 '24 08:10 cryptochecktool