PT-2023-24676 · Srs · Srs

Pwntester · Published 2023-06-12 · Updated 2023-06-22 · CVE-2023-34105

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SRS versions prior to 5.0.157 SRS versions prior to 5.0-b1 SRS versions prior to 6.0.48

Description The issue concerns a drive-by command injection in the api-server server. An attacker can send a request to the "/api/v1/snapshots" endpoint with any commands to be executed as part of the body of the POST request, potentially leading to Remote Code Execution (RCE).

Recommendations For versions prior to 5.0.157, update to version 5.0.157 or later. For versions prior to 5.0-b1, update to version 5.0-b1 or later. For versions prior to 6.0.48, update to version 6.0.48 or later.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2023-34105

GHSA-VPR5-779C-CX62

Affected Products

Srs

References · 6

• 🔥 https://github.com/ossrs/srs/security/advisories/GHSA-vpr5-779c-cx62 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34105.json · Exploit
• https://github.com/ossrs/srs/commit/1d878c2daaf913ad01c6d0bc2f247116c8050338 · Patch
• https://osv.dev/vulnerability/CVE-2023-34105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34105 · Security Note
• https://github.com/ossrs/srs/blob/1d11d02e4b82fc3f37e4b048cff483b1581482c1/trunk/research/api-server/server.go#L761 · Note