PT-2024-24235 · Tiagorlampert · Chaos

Published 2024-04-12 · Updated 2025-09-19 · CVE-2024-31839

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions tiagorlampert CHAOS version 5.0.1

Description The issue allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component. This is a form of Cross Site Scripting (XSS) that may enable a malicious actor to extract a JWT token by sending a malicious "/command" request.

Recommendations For tiagorlampert CHAOS version 5.0.1, consider disabling the sendCommandHandler function in the handler.go component as a temporary workaround until a patch is available. Restrict access to the "/command" API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-31839

GHSA-C5RV-HJJC-JV7M

GO-2024-2721

Affected Products

Chaos

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/chaos_rat_xss_to_rce.rb · Exploit
• 🔥 https://blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents · Exploit
• https://osv.dev/vulnerability/GO-2024-2721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31839 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31839 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c5rv-hjjc-jv7m · Vendor Advisory
• https://github.com/tiagorlampert/CHAOS · Note
• https://t.me/cybersecuritytechnologies/10682 · Telegram Post
• https://t.me/true_secator/7370 · Telegram Post
• https://t.me/aptreports/20037 · Telegram Post
• https://t.me/aptreports/19325 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1930840231294521666 · Twitter Post
• https://twitter.com/CVEnew/status/1779016069145112820 · Twitter Post
• https://twitter.com/arpsyndicate/status/1793330949675176138 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1969023722603573679 · Twitter Post