{"id":"CVE-2024-33434","aliases":["EUVD-2024-1861","GHSA-p3j6-f45h-hw5f","GHSA-xfjj-f699-rc79","GO-2024-2822"],"status":"published","title":"tiagorlampert CHAOS vulnerable to arbitrary code execution","description":"An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01354,"percentile":0.71791,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2024-04-12T06:33:24Z","modified":"2026-06-17T07:31:47Z","fixes":[{"ecosystem":"Go","package":"github.com/tiagorlampert/CHAOS","fixed_in":["0.0.0-20220716132853-b47438d36e3a"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/tiagorlampert/CHAOS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20220716132853-b47438d36e3a"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/tiagorlampert/CHAOS","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20220716132853-b47438d36e3a"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/tiagorlampert/CHAOS","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20220716132853-b47438d36e3a"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/tiagorlampert/CHAOS","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20220716132853-b47438d36e3a"}]}],"bundled":2}],"products":[{"vendor":"tiagorlampert","product":"chaos"}],"references":[{"url":"https://github.com/tiagorlampert/CHAOS/pull/95","tags":["x_transferred","web","fix"]},{"url":"https://gist.github.com/slimwang/d1ec6645ba9012a551ea436679244496","tags":["x_transferred","web"]},{"url":"https://web.archive.org/web/20240406061035/https://blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33434","tags":["advisory"]},{"url":"https://github.com/tiagorlampert/CHAOS/commit/1b451cf62582295b7225caf5a7b506f0bad56f6b","tags":["web","fix"]},{"url":"https://github.com/tiagorlampert/CHAOS/commit/24c9e109b5be34df7b2bce8368eae669c481ed5e","tags":["web","fix"]},{"url":"https://github.com/tiagorlampert/CHAOS/commit/b47438d36e3ad746de8c009e644f6e5396703f25","tags":["web"]},{"url":"https://web.archive.org/web/20240406061035/https://blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xfjj-f699-rc79"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30850","tags":["advisory"]},{"url":"https://blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents","tags":["web"]},{"url":"https://github.com/tiagorlampert/CHAOS","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-33434","description":"An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering.","status":"published","published":"2024-05-07T00:00:00Z","modified":"2026-04-03T16:58:56.413Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:21.404483Z"}],"euvd":[{"id":"EUVD-2024-1861","description":"An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering.","status":"published","published":"2024-05-07T00:00:00Z","modified":"2026-04-03T16:58:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:25:16.550278Z"}],"ghsa":[{"id":"GHSA-xfjj-f699-rc79","title":"tiagorlampert CHAOS vulnerable to arbitrary code execution","description":"An issue in tiagorlampert CHAOS before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering.","status":"published","published":"2024-05-07T15:30:37Z","modified":"2026-04-06T23:06:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:39:50.076383Z"}],"nvd":[{"id":"CVE-2024-33434","description":"An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering.","status":"published","published":"2024-05-07T14:15:10.76Z","modified":"2026-06-17T07:31:47.42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:09:57.497105Z"}],"osv":[{"id":"GHSA-p3j6-f45h-hw5f","title":"tiagorlampert CHAOS vulnerable to command injections","description":"An issue in tiagorlampert CHAOS v5.0.1 allows a remote attacker to execute arbitrary code via the BuildClient function within client_service.go","status":"published","published":"2024-04-12T06:33:24Z","modified":"2024-05-09T18:36:35Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"GHSA-xfjj-f699-rc79","title":"tiagorlampert CHAOS vulnerable to arbitrary code execution","description":"An issue in tiagorlampert CHAOS before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering.","status":"published","published":"2024-05-07T15:30:37Z","modified":"2026-04-06T23:18:42.166521Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"GO-2024-2822","title":"Arbitrary code execution in github.com/tiagorlampert/CHAOS","description":"A remote attacker can execute arbitrary commands via crafted HTTP requests.","status":"published","published":"2024-05-09T16:51:38Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}