
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
## Private key management Private keys are imported and removed on the command line.
Private keys are imported and removed on the command line.
With a Private key that was exported from KeyChain. You'll be prompted for password that was set when exporting.
openssl pkcs12 -in Certificates.p12 -nocerts -out private_key.pem -nodes
# Where private_key.pem is your KEYFILE for the below.
RACK_ENV=production ./bin/rake keys:import name=NAME key=KEY_FILE
At this point key names are not important, but should be unique.
RACK_ENV=production ./bin/rake keys:remove name=NAME
OR
RACK_ENV=production ./bin/rake keys:remove checksum=XXXXX
If a key checksum is not known, it can be determined from either the original key file or the corresponding certificate file:
RACK_ENV=production ./bin/rake keys:checksum file=CERTIFICATE_OR_KEY_FILE
Required Dependencies:
Imagemagick
~ brew install imagemagick
Mongo
~ brew install mongo
Redis
~ brew install redis
Foreman
~ gem install foreman
Bundle install
~ gem install bundler
~ bundle
Yarn
yarn install
** Setup DB **
~ bundle exec rake db:setup
** Start the server **
~ foreman start
Open browser and goto
http://localhost:5000/admin
** Troubleshooting **
If you encounter issues installing libv8, try running the following command to successfully install it.
~ GCC_TREAT_WARNINGS_AS_ERRORS=NO gem install libv8 -v 3.16.14.13
If you encounter issues installing imagemagick, try running the following command to successfully install it.
~ brew uninstall imagemagick
~ brew install imagemagick@6 && brew link imagemagick@6 --force
~ brew link --overwrite imagemagick@6
~ echo 'export PATH="/usr/local/opt/imagemagick@6/bin:$PATH"' >> ~/.zshrc
FAQs
## Private key management Private keys are imported and removed on the command line.
We found that appinstall demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.