Security Market: Sonar DNS Field Command Injection Fixed by Developer

A developer discovered a command injection vulnerability in the DNS custom resolver field of Sonar, a macOS network scanning tool. The field, which accepts user input for custom DNS servers like Pi-hole or NextDNS, was passed to a privileged command without proper validation, potentially allowing arbitrary code execution as root. The fix involved allowlisting input to only accept valid IP addresses, passing arguments as an array instead of a shell string, and narrowing the privileged interface. The article also details three other security fixes made during a full pass: moving API tokens from a plist to the Keychain, preventing CSV export formula injection, and implementing atomic writes to avoid data corruption.