CVE-2023-34105 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected Products**: **SRS** by **ossrs**. 📅 **Affected Versions**: - v5.0.137 ~ v5.0.156 - v6.0.18 ~ v6.0.47 ✅ **Safe**: Versions outside these ranges.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔍 **Public Exp**: **Yes**. - **PoC**: Available via ProjectDiscovery Nuclei templates. - **Details**: GitHub links provided in references confirm active exploitation research. 🚀 **Status**: Exploitable in the wild.

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Fixed**: **Yes**. - **Patch**: Commit `1d878c2daaf913ad01c6d0bc2f247116c8050338` addresses the issue. - **Advisory**: GHSA-vpr5-779c-cx62 confirms the fix. 🔄 **Action**: Upgrade to patched versions immediately.

Q: Is it urgent? (Priority Suggestion)

⚡ **Urgency**: **HIGH**. - **CVSS**: 8.1 (High). - **Impact**: Full system takeover. - **Exploitability**: Public PoC exists. 📢 **Priority**: Patch immediately or isolate the service. Do not ignore!

Updated May 08, 2026 CVSS 7.5 · High

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SRS (Simple Realtime Server) has a **Command Injection** flaw in its `api-server`.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-78** (OS Command Injection). The `api-server` component fails to properly sanitize user inputs before passing them to system commands.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected Products**: **SRS** by **ossrs**. 📅 **Affected Versions**: 
- v5.0.137 ~ v5.0.156 
- v6.0.18 ~ v6.0.47 
✅ **Safe**: Versions outside these ranges.

Q4What can hackers do? (Privileges/Data)

💻 **Privileges**: **High** (Root/System level). 📊 **Data Impact**: Full Confidentiality, Integrity, and Availability loss.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **Medium**. 
- **Auth**: None required (PR:N). 
- **Network**: Remote (AV:N). 
- **User Interaction**: Required (UI:R) - likely via drive-by or specific API trigger.…

Read full answer (login)

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔍 **Public Exp**: **Yes**. 
- **PoC**: Available via ProjectDiscovery Nuclei templates. 
- **Details**: GitHub links provided in references confirm active exploitation research. 🚀 **Status**: Exploitable in the wild.

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check**: 
Check SRS version against affected ranges. 
Scan for `api-server` endpoints. 
Use Nuclei template `CVE-2023-34105.yaml` for automated detection.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Fixed**: **Yes**. 
- **Patch**: Commit `1d878c2daaf913ad01c6d0bc2f247116c8050338` addresses the issue. 
- **Advisory**: GHSA-vpr5-779c-cx62 confirms the fix. 🔄 **Action**: Upgrade to patched versions immediately.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: 
**Disable** the `api-server` if not needed. 
**Firewall**: Restrict access to API ports to trusted IPs only. 
**WAF**: Implement strict input filtering rules for API endpoints.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

⚡ **Urgency**: **HIGH**. 
- **CVSS**: 8.1 (High). 
- **Impact**: Full system takeover. 
- **Exploitability**: Public PoC exists. 
📢 **Priority**: Patch immediately or isolate the service. Do not ignore!

Continue exploring

Vulnerability detail Full AI analysis (login) ossrs CWE-78