CVE-2023-33965

Deeper analysis

Brook is a cross-platform programmable network tool whose tproxy server component is affected by CVE-2023-33965, a command-injection flaw (CWE-78) that permits drive-by remote code execution. The vulnerability carries a CVSS 3.1 score of 9.6 and stems from insufficient input validation when the tproxy service processes requests originating from a web browser.

An attacker can exploit the issue by luring a victim into visiting a malicious web page that issues crafted requests to the locally running tproxy instance; successful exploitation grants the attacker arbitrary code execution on the victim’s machine with the privileges of the tproxy process. No authentication or user interaction beyond visiting the page is required, and the attack surface is exposed whenever the tproxy server is active.

Public advisories and the referenced GitHub security notice GHSA-vfrj-fv6p-3cpf state that the flaw is resolved in Brook version 20230606; the corresponding commits (314d7070c37babf6c38a0fe1eada872bb74bf03e) implement the necessary sanitization. The EPSS score rose from a low baseline to a peak of 0.0857 before receding to its current value of 0.0081, indicating a period of increased exploitation interest after disclosure.