Description
苹果IOS端IPA签名工具的/api/sign/sign接口存在任意命令执行漏洞，攻击者可以通过该漏洞在系统上执行任意命令，从而可能导致系统被完全控制。
苹果IOS端IPA签名工具 /api/sign/sign 命令执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/adysec/POC/blob/main/wpoc/%E5%88%86%E5%8F%91%E7%AD%BE%E5%90%8D%E7%B3%BB%E7%BB%9F/%E8%8B%B9%E6%9E%9CIOS%E7%AB%AFIPA%E7%AD%BE%E5%90%8D%E5%B7%A5%E5%85%B7Sign.php%E5%89%8D%E5%8F%B0%E4%BB%BB%E6%84%8F%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
https://cn-sec.com/archives/3386102.html
https://www.tutusec.com/1339.html