### [CVE-2017-15924](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15924)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions.

### POC

#### Reference
- http://openwall.com/lists/oss-security/2017/10/13/2
- https://github.com/shadowsocks/shadowsocks-libev/issues/1734
- https://www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev/

#### Github
- https://github.com/201755110121/kcp
- https://github.com/5l1v3r1/docker-shadowsocks
- https://github.com/andir/nixos-issue-db-example
- https://github.com/beermix/docker-ss
- https://github.com/danshan/ssproxy
- https://github.com/hadwinzhy/docker-shadowsocks
- https://github.com/icepyb/myss
- https://github.com/jkhaoqi110/shadowsocks-privoxy
- https://github.com/pluto-pluto/ss
- https://github.com/yueyanglouji/ss-proxy
- https://github.com/zhanglc/shadowsocks