CVE-2017-15924
Debian Security Advisory 4009-1
Severity Score
7.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions.
En manager.c en ss-manager en shadowsocks-libev 3.1.0, un análisis sintáctico incorrecto permite que se inyecten comandos mediante metacaracteres shell en una petición de configuración JSON recibida mediante tráfico UDP 127.0.0.1. Esto está relacionado con las funciones add_server, build_config y construct_command_line.
Niklas Abel discovered that insufficient input sanitising in the the ss-manager component of shadowsocks-libev, a lightweight socks5 proxy, could result in arbitrary shell command execution.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-10-27 CVE Reserved
- 2017-10-27 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://openwall.com/lists/oss-security/2017/10/13/2 | Mailing List | |
| https://github.com/shadowsocks/shadowsocks-libev/commit/c67d275803dc6ea22c558d06b1f7ba9f94cd8de3 | Third Party Advisory | |
| https://github.com/shadowsocks/shadowsocks-libev/issues/1734 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.debian.org/security/2017/dsa-4009 | 2019-10-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.3.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.3.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.4.0 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.4.0" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.4.1 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.4.1" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.4.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.4.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.4.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.4.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.4.4 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.4.4" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.4.5 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.4.5" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.4.6 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.4.6" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.4.7 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.4.7" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.4.8 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.4.8" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.5.0 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.5.0" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.5.1 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.5.1" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.5.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.5.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.5.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.5.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.6.1 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.6.1" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.6.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.6.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.6.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.6.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 1.6.4 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "1.6.4" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.0.1 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.0.1" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.0.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.0.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.0.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.0.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.0.4 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.0.4" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.0.5 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.0.5" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.0.6 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.0.6" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.0.7 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.0.7" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.0.8 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.0.8" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.1.0 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.1.0" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.1.1 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.1.1" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.1.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.1.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.1.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.1.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.1.4 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.1.4" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.2.0 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.2.0" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.2.1 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.2.1" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.2.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.2.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.2.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.2.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.3.0 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.3.0" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.3.1 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.3.1" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.3.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.3.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.3.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.3.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.4.0 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.4.0" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.4.1 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.4.1" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.4.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.4.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.4.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.4.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.4.4 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.4.4" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.4.5 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.4.5" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.4.6 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.4.6" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.4.7 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.4.7" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.4.8 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.4.8" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.5.0 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.5.0" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.5.1 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.5.1" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.5.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.5.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.5.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.5.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.5.4 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.5.4" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.5.5 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.5.5" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.5.6 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.5.6" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.6.0 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.6.0" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.6.1 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.6.1" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.6.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.6.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 2.6.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "2.6.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 3.0.0 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "3.0.0" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 3.0.1 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "3.0.1" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 3.0.2 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "3.0.2" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 3.0.3 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "3.0.3" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 3.0.4 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "3.0.4" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 3.0.5 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "3.0.5" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 3.0.6 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "3.0.6" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 3.0.7 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "3.0.7" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 3.0.8 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "3.0.8" | - |
Affected
| ||||||
| Shadowsocks Search vendor "Shadowsocks" | Shadowsocks-libev Search vendor "Shadowsocks" for product "Shadowsocks-libev" | 3.1.0 Search vendor "Shadowsocks" for product "Shadowsocks-libev" and version "3.1.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.2 Search vendor "Debian" for product "Debian Linux" and version "9.2" | - |
Affected
| ||||||