CRITICAL9.6

GHSA-vfrj-fv6p-3cpf

Brook's tproxy server is vulnerable to a drive-by command injection.

Quick fix

GHSA-vfrj-fv6p-3cpf — github.com/txthinking/brook: upgrade to the fixed version with the command below.

go get github.com/txthinking/brook@v20230606

Details

The `tproxy` server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local `tproxy` service leading to remote code execution.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/txthinking/brook

Introduced in: 0Fixed in: 20230606

Fixgo get github.com/txthinking/brook@v20230606

References

https://github.com/txthinking/brook/security/advisories/GHSA-vfrj-fv6p-3cpf[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-33965[ADVISORY]
https://github.com/txthinking/brook/commit/314d7070c37babf6c38a0fe1eada872bb74bf03e[WEB]
https://github.com/txthinking/brook[PACKAGE]