This exporter, while nice to have, opens the server it is running on to code injection vulnerabilities as the command line parameters are not escaped and executed as-is.
Try it yourself:
curl "localhost:8085?target=\`touch%20iamnotsupposedtobehere\`"
You will then find a file where the .py script is located: iamnotsupposedtobehere
This exporter, while nice to have, opens the server it is running on to code injection vulnerabilities as the command line parameters are not escaped and executed as-is.
Try it yourself:
You will then find a file where the .py script is located:
iamnotsupposedtobehere