cve/2017/CVE-2017-15924.md

CVE-2017-15924

Description

In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions.

POC

Reference

• http://openwall.com/lists/oss-security/2017/10/13/2
• https://github.com/shadowsocks/shadowsocks-libev/issues/1734
• https://www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev/

Github

• https://github.com/201755110121/kcp
• https://github.com/5l1v3r1/docker-shadowsocks
• https://github.com/andir/nixos-issue-db-example
• https://github.com/beermix/docker-ss
• https://github.com/danshan/ssproxy
• https://github.com/hadwinzhy/docker-shadowsocks
• https://github.com/icepyb/myss
• https://github.com/jkhaoqi110/shadowsocks-privoxy
• https://github.com/pluto-pluto/ss
• https://github.com/yueyanglouji/ss-proxy
• https://github.com/zhanglc/shadowsocks