Conquering the Moon (luarocks.org remote code execution exploit)
Summary
This article provides a deep dive into a remote code execution vulnerability in luarocks.org, illustrating how a malicious rockspec could lead to full server compromise. It dissects the sandbox weaknesses, the exploit chain (including Lua bytecode patching and environment manipulation), and the steps needed to achieve code execution, while noting that a patch was released and a PoC exists. The piece emphasizes the risk of sandbox bypasses and the need for robust isolation in hosting environments.