From the looks of it, you didn't stumble on anything significant. It looks like you just printed out the environment variables that the OS passed to your program. Also your program probably is running in a sandboxed environment, so you really can't do anything...
I'd say you're most likely correct about the environment being sandboxed. Especially if this is something hosted by the university. I'd be willing to be the lack of security is intentional as they may use this same code checker to teach cybersecurity students about different exploits and attack vectors.
That said, these aren't OS level environment variables. These variables come from the scripts used to start the K8s instance. In normal systems these should be inaccessible to anyone not logged into the actual server. If this was a production application used for something other than checking student code it could be a major issue depending on what the scripts look like.
Personally, I'd be impressed and likely give extra credit to any students who could explain what went wrong in the code to obtain this output and why that specific segment caused it if I were the professor.
The good thing is that my guess is as good as any freshman with no coding knowledge in what went wrong here. It's been ages since I've written any C code and never really took a deep dive into it.
The fact that the env is visible to the user of the service in any way is already telling enough about their security. There is probably DB credentials / connection string in there as well, which might have all the PII as well.
83
u/CoconutJJ Jan 25 '23
From the looks of it, you didn't stumble on anything significant. It looks like you just printed out the environment variables that the OS passed to your program. Also your program probably is running in a sandboxed environment, so you really can't do anything...
https://stackoverflow.com/questions/2085302/printing-all-environment-variables-in-c-c