CVE-2023-33965: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

June 6, 2023

Brook is a cross-platform programmable network tool. The tproxy server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local tproxy service leading to remote code execution. A patch is available in version 20230606.

References

github.com/advisories/GHSA-vfrj-fv6p-3cpf
github.com/txthinking/brook/commit/314d7070c37babf6c38a0fe1eada872bb74bf03e
github.com/txthinking/brook/security/advisories/GHSA-vfrj-fv6p-3cpf
nvd.nist.gov/vuln/detail/CVE-2023-33965

Code Behaviors & Features

Detect and mitigate CVE-2023-33965 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →