Executive Summary
A code injection vulnerability has been discovered in zevorn rt-claw up to 0.2.0. This vulnerability affects the Telegram-to-AI Tool Execution Flow and has a CVSS score of 6.3. It can be exploited remotely, and a proof-of-concept exploit has been released to the public.
Technical Analysis
The vulnerability is classified as a code injection vulnerability (CWE-74, CWE-94). It is located in the function `tool_run_script_execute` of the file `claw/services/tools/script.c`. The attack vector is remote, and the vulnerability can be triggered by manipulating the input to the affected function.
How It Gets Exploited
An unauthenticated remote attacker can exploit this vulnerability by sending a crafted payload to the Telegram-to-AI Tool Execution Flow. The attacker would need to send a malicious input to the `tool_run_script_execute` function, which would then inject malicious code. The attacker could achieve code execution, potentially leading to a compromise of the affected system.
Impact Assessment
The vulnerability affects zevorn rt-claw versions 0.1 and 0.2.0. A successful exploit could lead to code execution, potentially resulting in a compromise of the affected system. The CVSS score of 6.3 indicates a medium severity level.
Recommended Actions
To mitigate this vulnerability, it is recommended to update zevorn rt-claw to a version later than 0.2.0. Additionally, users should ensure that the Telegram-to-AI Tool Execution Flow is properly configured and that any unnecessary features are disabled. Detection guidance: Monitor for suspicious activity in the Telegram-to-AI Tool Execution Flow, and implement a Web Application Firewall (WAF) rule to block malicious payloads.
Sources
- National Vulnerability Database (NVD)
- Vuldb.com