CVE-2024-33434
Published: 07 May 2024
Summary
CVE-2024-33434 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-33434 is an OS command injection vulnerability (CWE-78) in the tiagorlampert CHAOS remote access tool, affecting versions up to 5.0.1 prior to commits 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e. The flaw stems from unsafe concatenation of an unsanitized filename argument directly into a buildStr string used for command construction, enabling arbitrary code execution. It carries a CVSS 3.1 score of 9.8 reflecting network-accessible exploitation with no required credentials or user interaction.
An unauthenticated remote attacker can supply a malicious filename value to trigger command injection, achieving full control over the affected CHAOS instance including the ability to execute arbitrary operating-system commands.
Public references point to a GitHub pull request that addresses the issue through input sanitization and safer command handling; operators should update to a patched build. The associated EPSS score remains low and stable near 0.0779 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1861
Vulnerability details
An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.