slimwang

## CVE-2024-33434.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                slimwang
                / CVE-2024-33434.md
            
            
              Last active
              May 7, 2024 00:34
            
              
                CVE-2024-33434
              
          
    CVE-2024-33434


affected product: https://github.com/tiagorlampert/CHAOS
affected version: commit before 1b451cf62582295b7225caf5a7b506f0bad56f6b & 24c9e109b5be34df7b2bce8368eae669c481ed5e
vulnerability type: RCE (Command Injection)

Details

In services/client_service.go, the author uses fmt.Sprintf() to build buildStr, then executes it with exec.Command() :