支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2024-3094 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Xz: malicious code in distributed source
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
来源: 美国国家漏洞数据库 NVD
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
内嵌的恶意代码
来源: 美国国家漏洞数据库 NVD
Vulnerability Title
xz 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
xz是一个应用软件。用于支持读取和写入xz压缩流。 XZ Utils 5.6.0版本和5.6.1版本存在安全漏洞，该漏洞源于允许攻击者嵌入恶意代码。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
厂商产品影响版本CPE订阅
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 6-cpe:/o:redhat:enterprise_linux:6
Red HatRed Hat Enterprise Linux 7-cpe:/o:redhat:enterprise_linux:7
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat JBoss Enterprise Application Platform 8-cpe:/a:redhat:jboss_enterprise_application_platform:8
二、漏洞 CVE-2024-3094 的公开POC
#POC 描述源链接神龙链接
1Information for CVE-2024-3094https://github.com/byinarie/CVE-2024-3094-infoPOC详情
2Quick and dirty PoC for checking whether a vulnerable version of xz-utils is installed (CVE-2024-3094)https://github.com/FabioBaroni/CVE-2024-3094-checkerPOC详情
3Verify that your XZ Utils version is not vulnerable to CVE-2024-3094https://github.com/lypd0/CVE-2024-3094-Vulnerabity-CheckerPOC详情
4Nonehttps://github.com/OpensourceICTSolutions/xz_utils-CVE-2024-3094POC详情
5Script to detect CVE-2024-3094.https://github.com/bioless/xz_cve-2024-3094_detectionPOC详情
6This repository contains a Bash script and a one-liner command to verify if a system is running a vulnerable version of the "xz" utility, as specified by CVE-2024-3094.https://github.com/Hacker-Hermanos/CVE-2024-3094_xz_checkPOC详情
7Nonehttps://github.com/Fractal-Tess/CVE-2024-3094POC详情
8Nonehttps://github.com/wgetnz/CVE-2024-3094-checkPOC详情
9History of commits related to the xz backdoor Discovered On March 29, 2024: CVE-2024-3094.https://github.com/emirkmo/xz-backdoor-githubPOC详情
10xz exploit to privilege escalation in Linuxhttps://github.com/Jooose001/CVE-2024-3094-EXPLOITPOC详情
11Nonehttps://github.com/ashwani95/CVE-2024-3094POC详情
12Checker for CVE-2024-3094 where malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code.https://github.com/harekrishnarai/xz-utils-vuln-checkerPOC详情
13K8S and Docker Vulnerability Check for CVE-2024-3094https://github.com/teyhouse/CVE-2024-3094POC详情
14This project contains a shell script designed to help users identify and fix installations of xz-utils affected by the CVE-2024-3094 vulnerability. Versions 5.6.0 and 5.6.1 of xz-utils are known to be vulnerable, and this script aids in detecting them and optionally downgrading to a stable, un-compromised version (5.4.6).https://github.com/alokemajumder/CVE-2024-3094-Vulnerability-Checker-FixerPOC详情
15Nonehttps://github.com/Horizon-Software-Development/CVE-2024-3094POC详情
16Nonehttps://github.com/hazemkya/CVE-2024-3094-checkerPOC详情
17An ssh honeypot with the XZ backdoor. CVE-2024-3094https://github.com/lockness-Ko/xz-vulnerable-honeypotPOC详情
18Nonehttps://github.com/brinhosa/CVE-2024-3094-One-LinerPOC详情
19CVE-2024-3094https://github.com/isuruwa/CVE-2024-3094POC详情
20Nonehttps://github.com/k4t3pr0/Check-CVE-2024-3094POC详情
21A script to detect if xz is vulnerable - CVE-2024-3094https://github.com/Yuma-Tsushima07/CVE-2024-3094POC详情
22Nonehttps://github.com/jfrog/cve-2024-3094-toolsPOC详情
23Nonehttps://github.com/krascovict/OSINT---CVE-2024-3094-POC详情
24Ansible playbook for patching CVE-2024-3094https://github.com/Simplifi-ED/CVE-2024-3094-patcherPOC详情
25Nonehttps://github.com/gayatriracha/CVE-2024-3094-Nmap-NSE-scriptPOC详情
26Nonehttps://github.com/Mustafa1986/CVE-2024-3094POC详情
27XZ-Utils工具库恶意后门植入漏洞(CVE-2024-3094)https://github.com/MrBUGLF/XZ-Utils_CVE-2024-3094POC详情
28Nonehttps://github.com/galacticquest/cve-2024-3094-detectPOC详情
29Nonehttps://github.com/zgimszhd61/cve-2024-3094-detect-toolPOC详情
30Nonehttps://github.com/mightysai1997/CVE-2024-3094-infoPOC详情
31Nonehttps://github.com/mightysai1997/CVE-2024-3094POC详情
32CVE-2024-3094https://github.com/mesutgungor/xz-backdoor-vulnerabilityPOC详情
33Obsidian notes about CVE-2024-3094https://github.com/reuteras/CVE-2024-3094POC详情
34notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)https://github.com/amlweems/xzbotPOC详情
35Checker - CVE-2024-3094https://github.com/gustavorobertux/CVE-2024-3094POC详情
36Nonehttps://github.com/ackemed/detectar_cve-2024-3094POC详情
37XZ Backdoor Extracthttps://github.com/0xlane/xz-cve-2024-3094POC详情
38Nonehttps://github.com/dah4k/CVE-2024-3094POC详情
39Script en bash para revisar si tienes la vulnerabilidad CVE-2024-3094.https://github.com/hackingetico21/revisaxzutilsPOC详情
40CVE-2024-3094 XZ Backdoor Detectorhttps://github.com/devjanger/CVE-2024-3094-XZ-Backdoor-DetectorPOC详情
41Detectar CVE-2024-3094https://github.com/ScrimForever/CVE-2024-3094POC详情
42CVE-2024-3094 - Checker (fix for arch etc)https://github.com/pentestfunctions/CVE-2024-3094POC详情
43Dockerfile and Kubernetes manifests for reproduce CVE-2024-3094https://github.com/r0binak/xzk8sPOC详情
44apocalypxze: xz backdoor (2024) AKA CVE-2024-3094 related linkshttps://github.com/przemoc/xz-backdoor-linksPOC详情
45Our current information about the CVE-2024-3094 backdoor.https://github.com/CyberGuard-Foundation/CVE-2024-3094POC详情
46Collection of Detection, Fix, and exploit for CVE-2024-3094 https://github.com/Security-Phoenix-demo/CVE-2024-3094-fix-exploitsPOC详情
47This is a container environment running CVE-2024-3094 sshd backdoor instance, working with https://github.com/amlweems/xzbot project. IT IS NOT Docker, just implemented by chroot.https://github.com/MagpieRYL/CVE-2024-3094-backdoor-env-containerPOC详情
48Verify if your installed version of xz-utils is vulnerable to CVE-2024-3094 backdoorhttps://github.com/Bella-Bc/xz-backdoor-CVE-2024-3094-CheckPOC详情
49The repository consists of a checker file that confirms if your xz version and xz-utils package is vulnerable to CVE-2024-3094.https://github.com/TheTorjanCaptain/CVE-2024-3094-CheckerPOC详情
50The CVE-2024-3094 Checker is a Bash tool for identifying if Linux systems are at risk from the CVE-2024-3094 flaw in XZ/LZMA utilities. It checks XZ versions, SSHD's LZMA linkage, and scans for specific byte patterns, delivering results in a concise table format. https://github.com/iheb2b/CVE-2024-3094-CheckerPOC详情
51A tutorial on how to detect the CVE 2024-3094https://github.com/felipecosta09/cve-2024-3094POC详情
52Scans liblzma from xu-utils for backdoor (CVE-2024-3094)https://github.com/weltregie/liblzma-scanPOC详情
53Ansible playbooks designed to check and remediate CVE-2024-3094 (XZ Backdoor)https://github.com/crfearnworks/ansible-CVE-2024-3094POC详情
54A small repo with a single playbook.https://github.com/robertdebock/ansible-playbook-cve-2024-3094POC详情
55An Ansible Role that installs the xz backdoor (CVE-2024-3094) on a Debian host and optionally installs the xzbot tool.https://github.com/badsectorlabs/ludus_xz_backdoorPOC详情
56Scan for files containing the signature from the `xz` backdoor (CVE-2024-3094)https://github.com/Juul/xz-backdoor-scanPOC详情
57Nonehttps://github.com/drdry2/CVE-2024-3094-EXPLOITPOC详情
58La siguiente regla YARA ayuda a detectar la presencia del backdoor en la librería liblzma comprometida en sistemas que utilizan las versiones 5.6.0 y 5.6.1 de la herramienta de compresión XZ.https://github.com/fevar54/Detectar-Backdoor-en-liblzma-de-XZ-utils-CVE-2024-3094-POC详情
59Nonehttps://github.com/AlexDoe11/CVE-2024-3094-EXPLOITPOC详情
60XZ Utils CVE-2024-3094 POC for Kuberneteshttps://github.com/neuralinhibitor/xzwhyPOC详情
61Basic POC to test CVE-2024-3094https://github.com/shefirot/CVE-2024-3094POC详情
62SSH EXPLOIT BYPASS AUTH SSHhttps://github.com/DANO-AMP/CVE-2024-3094POC详情
63GNU IFUNC is the real culprit behind CVE-2024-3094https://github.com/robertdfrench/ifuncd-upPOC详情
64Just a script to test if xz is vulnerable to the cve 2024-3094.https://github.com/yq93dskimzm2/CVE-2024-3094POC详情
65Presentazione per il corsi di sicurezza Informatica sulla vulnerabilità CVE-2024-3094https://github.com/AndreaCicca/Sicurezza-Informatica-PresentazionePOC详情
66CVE-2024-3094 (XZ Backdoor) Toolshttps://github.com/XiaomingX/cve-2024-3094-xz-backdoor-exploitPOC详情
67Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library. https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-3094.yamlPOC详情
68CVE-2024-3094 실습 환경 구축 및 보고https://github.com/been22426/CVE-2024-3094POC详情
69Shell scripts to identify and fix installations of xz-utils affected by the CVE-2024-3094 vulnerability. Versions 5.6.0 and 5.6.1 of xz-utils are known to be vulnerable, and this script aids in detecting them and optionally downgrading to a stable, un-compromised version (5.4.6) or upgrading to latest version. Added Ansible Playbookhttps://github.com/gensecaihq/CVE-2024-3094-Vulnerability-Checker-FixerPOC详情
70Ansible playbooks designed to check and remediate CVE-2024-3094 (XZ Backdoor)https://github.com/KaminaDuck/ansible-CVE-2024-3094POC详情
71It was determined that malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. # It was determined that only certain operating systems and operating system versions were affected by this vulnerability.https://github.com/laxmikumari615/Linux---Security---Detect-and-Mitigate-CVE-2024-3094POC详情
72A XZ backdoor vulnerability explained in detailshttps://github.com/valeriot30/cve-2024-3094POC详情
73Threat intelligence report analyzing the xz-utils backdoor vulnerability (CVE-2024-3094)https://github.com/24Owais/threat-intel-cve-2024-3094POC详情
74CVE-2024-3094https://github.com/Dermot-lab/TryHackPOC详情
75Security analysis project: Real-world CVE breakdownhttps://github.com/Ikram124/CVE-2024-3094-analysisPOC详情
76Nonehttps://github.com/ykhurshudyan-blip/CVE-2024-3094POC详情
77CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components.https://github.com/mrk336/CVE-2024-3094POC详情
78Nonehttps://github.com/Titus-soc/-CVE-2024-3094-Vulnerability-Checker-Fixer-PublicPOC详情
79Obsidian notes about CVE-2024-3094https://github.com/zpxlz/CVE-2024-3094POC详情
80Investigation into the XZ Utils backdoor (CVE-2024-3094): chronology, attack chain, risk to SSH, and supply-chain insights. Includes slides, sources, and mitigations (parity checks, attestations, or SBOMs, as well as SLSA)https://github.com/M1lo25/CS50FinalProjectPOC详情
81Script to obfuscate a payload the same way as it was done by the XZ utils attack (CVE-2024-3094)https://github.com/ThomRgn/xzutils_backdoor_obfuscationPOC详情
82CVE-2024-3094https://github.com/B1ack4sh/Blackash-CVE-2024-3094POC详情
83CVE-2024-3094https://github.com/Ashwesker/Blackash-CVE-2024-3094POC详情
84Nonehttps://github.com/hariskhalil555000-sketch/What-utility-does-CVE-2024-3094-refer-to-POC详情
85This repository contains a Bash script and a one-liner command to verify if a system is running a vulnerable version of the "xz" utility, as specified by CVE-2024-3094.https://github.com/HackerHermanos/CVE-2024-3094_xz_checkPOC详情
86Nonehttps://github.com/encikayelwhitehat-glitch/CVE-2024-3094POC详情
87Nonehttps://github.com/BOSE122/CVE-2024-3094POC详情
88Nonehttps://github.com/spidygal/CVE-2024-3094-Nmap-NSE-scriptPOC详情
89Python demo simulating CVE-2024-3094: a supply chain backdoor in XZ Utils with a trigger-based stealth activation.https://github.com/hackura/xz-cve-2024-3094POC详情
AI 生成 POC高级

未找到公开 POC。

登录以生成 AI POC
三、漏洞 CVE-2024-3094 的情报信息
Please 登录 to view more intelligence information
四、漏洞 CVE-2024-3094 的评论

暂无评论

发表评论