CVE-2024-33434: tiagorlampert CHAOS vulnerable to arbitrary code execution
(updated )
An issue in tiagorlampert CHAOS before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the filename argument into the buildStr string without any sanitization or filtering.
References
- gist.github.com/slimwang/d1ec6645ba9012a551ea436679244496
- github.com/advisories/GHSA-xfjj-f699-rc79
- github.com/tiagorlampert/CHAOS
- github.com/tiagorlampert/CHAOS/commit/1b451cf62582295b7225caf5a7b506f0bad56f6b
- github.com/tiagorlampert/CHAOS/commit/24c9e109b5be34df7b2bce8368eae669c481ed5e
- github.com/tiagorlampert/CHAOS/commit/b47438d36e3ad746de8c009e644f6e5396703f25
- github.com/tiagorlampert/CHAOS/pull/95
- nvd.nist.gov/vuln/detail/CVE-2024-33434
- web.archive.org/web/20240406061035/https://blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents
Code Behaviors & Features
Detect and mitigate CVE-2024-33434 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →