mirror of
https://github.com/0xMarcio/cve.git
synced 2026-04-21 09:56:14 +02:00
0xMarcio
1.3 KiB
1.3 KiB
CVE-2017-15924
Description
In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions.
POC
Reference
- http://openwall.com/lists/oss-security/2017/10/13/2
- https://github.com/shadowsocks/shadowsocks-libev/issues/1734
- https://www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev/
Github
- https://github.com/201755110121/kcp
- https://github.com/5l1v3r1/docker-shadowsocks
- https://github.com/andir/nixos-issue-db-example
- https://github.com/beermix/docker-ss
- https://github.com/danshan/ssproxy
- https://github.com/hadwinzhy/docker-shadowsocks
- https://github.com/icepyb/myss
- https://github.com/jkhaoqi110/shadowsocks-privoxy
- https://github.com/pluto-pluto/ss
- https://github.com/seokjeon/SARD-vs-CVE
- https://github.com/yueyanglouji/ss-proxy
- https://github.com/zhanglc/shadowsocks