Vulnerability · Published Dec 23, 2024 · Assigned by GitHub_M

CVE-2024-53256Rizin has a command injection via RzBinInfo bclass due legacy code

High 7.8

In plain English

A high-severity OS command injection in rizin from rizinorg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)1.2%top 31.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code which suffered a command injection due the usage of `rz_core_cmdf` to invoke the command `m` which was removed in v0.1.x. A malicious binary defining `bclass` (part of RzBinInfo) is executed if `rclass` (part of RzBinInfo) is set to `fs`; the vulnerability can be exploited by any bin format where `bclass` and `rclass` are user defined. This vulnerability is fixed in 0.7.4.

Affected products (as reported)

Vendor	Product	Versions
rizinorg	rizin	< 0.7.4

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/rizinorg/rizin/security/advisories/GHSA-5jhc-frm4-p8v9 x_refsource_CONFIRM
https://github.com/rizinorg/rizin/commit/db6c5b39c065ce719f587c9815c47fbb834b10fa x_refsource_MISC
https://github.com/rizinorg/rizin/blob/be24ca8879ed9c58f288bdf21c271b6294720da4/librz/main/rizin.c#L1275-L1278 x_refsource_MISC