Vulnerability · Published Jun 1, 2023 · Assigned by GitHub_M
CVE-2023-33965Brook's tproxy server is vulnerable to a drive-by command injection.
Critical 9.7
In plain English
A critical-severity OS command injection in brook from txthinking. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local `tproxy` service leading to remote code execution. A patch is available in version 20230606.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/txthinking/brook | 20230606 | GHSA-vfrj-fv6p-3cpf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| txthinking | brook | < 20230606 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H