GHSA-723h-x37g-f8qm

Chaosblade vulnerable to OS command execution

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-47105

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/chaosblade-io/chaosblade	>= 0.0.3, < 1.7.4	1.7.4

Details

As written in the advisory (Markdown source, shown as plain text).

exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-47105 advisory
https://github.com/chaosblade-io/chaosblade/commit/6bc73c31e14ea2b1bfc30f359e1fe952859d9adc web
https://github.com/advisories/GHSA-723h-x37g-f8qm advisory
https://github.com/chaosblade-io/chaosblade package
https://github.com/chaosblade-io/chaosblade/blob/0a07380c9899febb2b544132783b376b44226cca/exec/os/executor.go#L68 web
https://narrow-oatmeal-0c0.notion.site/ChaosBlade-Remote-Command-Execution-CVE-2023-47105-4f5459046488436caaec2bced6ff26d7 web