Earlier quoted context omitted.
you are just exploiting bash's argument expansion /etc/sudoers does not use "bash's argument expansion". to feed some additional shell stuff to bash /after/ the logrotate command Wrong. It's clearly about a sudoers rule which uses wildcards (see sudoers(5) "Wildcards" section. The entire security issue is with the dumb bash script; it has nothing to do with anything else. The security issue is that a sudoers(5) rule…
It's ok to be wrong; it's not ok to change your original writeup and continue to insist that you have been right all along. To the extent there is a security issue here, it does not lie with any of the software in question. You have not exploited sudo, ssh, bash, logrotate, wget, or anything else in the system. The failure is instead a systemic one that allowed an ineffective and insecure configuration to be applied…
I removed the section about the bash restriction (which was not particularly important), but the content of the post did not change: https://github.com/MegaManSec/JoshuaHu/commit/11cd746a0efb02...
The failure is instead a systemic one that allowed an ineffective and insecure configuration to be applied to a system. Some process (or maybe no defined process) 1) led "the administrator" of the system in question to do it and 2) didn't provide any verification or review of the configuration change.
Almost as if the post is therefore detailing _how_ it is an ineffective and an insecure configuration.