CVE-2023-34105CWE-78

SRS has command injection vulnerability in demonstration api-server for HTTP callback.

High · published June 12, 2023

CVSS v3.1
7.5
EPSS
9%
Percentile
95.1
In the wild
Unconfirmed
What it is

SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's `api-server` server is vulnerable to a drive-by command injection. An attacker may send a request to the `/api/v1/snapshots` endpoint containing any commands to be executed as part of the body of the POST request. This issue may lead to Remote Code Execution (RCE). Versions 5.0.157, 5.0-b1, and 6.0.48 contain a fix.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.08689 · 95.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2023-06-12T16:30Z
EPSS history
Timeline
  • 12 JUN 16:30Z
    SRS has command injection vulnerability in demonstration api-server for HTTP callback.
    cvelistv5