Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 27 Oct 2017 18:09:53 +0200
From: Salvatore Bonaccorso <>
To: X41 D-Sec GmbH Advisories <>
Subject: Re: Advisory X41-2017-010: Command Execution in


On Fri, Oct 13, 2017 at 06:44:21PM +0200, X41 D-Sec GmbH Advisories wrote:
> X41 D-Sec GmbH Security Advisory: X41-2017-010
> Command Execution in Shadowsocks-libev
> ======================================
> Overview
> --------
> Severity Rating: High
> Confirmed Affected Versions: 3.1.0
> Confirmed Patched Versions: N/A
> Vendor: Shadowsocks
> Vendor URL:
> Vector: Local
> Credit: X41 D-Sec GmbH, Niklas Abel
> Status: Public
> CVE: not yet assigned
> Advisory-URL:
> Summary and Impact
> ------------------
> Shadowsocks-libev offers local command execution per configuration file
> or/and additionally, code execution per UDP request on
> The configuration file on the file system or the JSON configuration
> received via UDP request is parsed and the arguments are passed to the
> "add_server" function.
> The function calls "construct_command_line(manager, server);" which
> returns a string from the parsed configuration.
> The string gets executed at line 486 "if (system(cmd) == -1) {", so if a
> configuration parameter contains "||evil command&&" within the "method"
> parameter, the evil command will get executed.
> The ss-manager uses UDP port 8830 to get control commands on
> By default no authentication is required, although a password can be set
> with the '-k' parameter.

CVE-2017-15924 has been assigned for this issue.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.