Vulnerability · Published May 7, 2024 · Assigned by mitre

CVE-2024-33434

Critical 9.8

In plain English

A critical-severity OS command injection in the github.com/tiagorlampert/CHAOS package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.4%top 28.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/tiagorlampert/CHAOS	0.0.0-20220716132853-b47438d36e3a	GHSA-p3j6-f45h-hw5f
Go	github.com/tiagorlampert/CHAOS	0.0.0-20220716132853-b47438d36e3a	GHSA-xfjj-f699-rc79
Go	github.com/tiagorlampert/CHAOS	0.0.0-20220716132853-b47438d36e3a	GO-2024-2822

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References