Bypassing dnsmasq dhcp-script limitations for command execution in config injection attacks

When researching networking devices, I frequently encounter a particular vulnerability: the ability to inject arbitrary options into dnsmasq's config files. These devices often delegate functionality to dnsmasq, and when they allow users to set configuration options, they might perform basic templating to generate configuration files that are then fed to dnsmasq. If the device fails to properly…