CVE-2024-33434 tiagorlampert CHAOS vulnerable to arbitrary code execution
Remote attackers can execute arbitrary code in the Go CHAOS library due to unsanitized filename concatenation in buildStr.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-33434?
CVE-2024-33434 is a critical command injection vulnerability in n/a, published on 7 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering.
Weakness: CWE-78
Which versions are affected by CVE-2024-33434?
2 open source packages ship an affected version, including github.com/tiagorlampert/CHAOS.
| Package | Affected | Fixed in |
|---|---|---|
github.com/tiagorlampert/CHAOS Go | All versions | 0.0.0-20220716132853-b47438d36e3a |
github.com/tiagorlampert/CHAOS Go | All versions | 0.0.0-20220716132853-b47438d36e3a |
How do I fix CVE-2024-33434?
Upgrade github.com/tiagorlampert/CHAOS to 0.0.0-20220716132853-b47438d36e3a or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-33434 being exploited?
There is no known exploitation of CVE-2024-33434 in the wild and no public exploit code.
Sources
Also known as CVE-2024-30850, GHSA-xfjj-f699-rc79.