Hacker News new | past | comments | ask | show | jobs | submit login

I just ran into the same thing while running Django locally with the runserver command. Besides the setuid request, there were several other requests at the same time;

code 400, message Bad request version ('\x9fX\x89\x88ã') code 400, message Bad request version ('·ü\x19.\x9f]\x00\x12\x00\x00ÿ\x01\x00\x01\x00\x00#\x00\x00\x00\x05\x00\x05\x01\x00\x00\x00\x00\x00+\x00\x07\x06ÚÚ\x03\x04\x03\x03\x00') code 400, message Bad request version ('û5') code 400, message Bad request version ('\x00\x12\x00\x10\x04\x03\x08\x04\x04\x01\x05\x03\x08\x05\x05\x01\x08\x06\x06\x01\x00+\x00\x07\x06ºº\x03\x04\x03\x03ÿ\x01\x00\x01\x00\x00#\x00\x00\x00')

Notice that what appear in the apparently binary strings are non-octal characters, presumably because that allows some exploit on parsing.




Reproducible at will by going to tetr.io, which presents itself as an online stacking game with ads.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: