CVE-2023-47105 Chaosblade vulnerable to OS command execution
Unauthenticated attackers can execute arbitrary OS commands in Chaosblade server mode via the cmd parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-47105?
CVE-2023-47105 is a high-severity command injection vulnerability in n/a, published on 18 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication.
Weakness: CWE-78
Which versions are affected by CVE-2023-47105?
3 open source packages ship an affected version, including github.com/chaosblade-io/chaosblade.
| Package | Affected | Fixed in |
|---|---|---|
github.com/chaosblade-io/chaosblade Go | From 0.0.3 | 1.7.4 |
github.com/chaosblade-io/chaosblade Go | From 0.0.3 | 1.7.4 |
github.com/chaosblade-io/chaosblade Go | From 0.0.3 | 1.7.4 |
How do I fix CVE-2023-47105?
Upgrade github.com/chaosblade-io/chaosblade to 1.7.4 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-47105 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-47105 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-723h-x37g-f8qm, GO-2024-3133.