Reposted by NTBBloodbath
During my work on Lux, I noticed an oddity in luarocks and launched a month-long investigation.
luarocks.org had a critical RCE allowing anyone to gain root access to the site with a package upload.
I will launch a blog post describing how the exploit works soon.
luarocks.org/security-inc...
luarocks.org
LuaRocks - The Lua package manager
A website for submitting and distributing Lua rocks