Cyber Resilience

CVE-2024-33434

CriticalRCE

Published: 07 May 2024

Published
07 May 2024
Modified
15 April 2026
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0760 92.0th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-33434 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2024-33434 is an OS command injection vulnerability (CWE-78) in the tiagorlampert CHAOS remote access tool, affecting versions up to 5.0.1 prior to commits 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e. The flaw stems from unsafe concatenation of an unsanitized filename argument directly into a buildStr string used for command construction, enabling arbitrary code execution. It carries a CVSS 3.1 score of 9.8 reflecting network-accessible exploitation with no required credentials or user interaction.

An unauthenticated remote attacker can supply a malicious filename value to trigger command injection, achieving full control over the affected CHAOS instance including the ability to execute arbitrary operating-system commands.

Public references point to a GitHub pull request that addresses the issue through input sanitization and safer command handling; operators should update to a patched build. The associated EPSS score remains low and stable near 0.0779 with no material increase after disclosure.

EU & UK References

Vulnerability details

An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References