CVE-2024-31839

Name of the Vulnerable Software and Affected Versions tiagorlampert CHAOS version 5.0.1

Description The issue allows a remote attacker to escalate privileges via the

sendCommandHandler

function in the handler.go component. This is a form of Cross Site Scripting (XSS) that may enable a malicious actor to extract a JWT token by sending a malicious "/command" request.

Recommendations For tiagorlampert CHAOS version 5.0.1, consider disabling the

sendCommandHandler

function in the handler.go component as a temporary workaround until a patch is available. Restrict access to the "/command" API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.