CVE-2024-3094 PoC — Xz: malicious code in distributed source

Source

https://github.com/hazemkya/CVE-2024-3094-checker

Associated Vulnerability

Title:Xz: malicious code in distributed source (CVE-2024-3094)
Description:Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Readme

# CVE-2024-3094 Detection and Remediation Script

This script is designed to detect and remediate a critical vulnerability, CVE-2024-3094, which affects the XZ Utils data compression library. The vulnerability was highlighted in a CISA Alert and has significant implications for system security. This Bash script offers both detection and remediation functionalities.

## Disclaimer

This script is provided "AS IS", without warranty of any kind. It has not been thoroughly tested across all environments and configurations. By running this script, you acknowledge and accept that you do so at your own risk.

## Usage

Clone the repository:

```shell
git clone https://github.com/hazemkya/CVE-2024-3094-checker.git
cd CVE-2024-3094-checker
```

**Default Detection Mode:** By default, the script operates in detection mode to only detect if your system is vulnerable.
```bash
./CVE-2024-3094-checker.sh
```

**Remediation Mode:** By using the -r flag, the script switches to remediation mode, where it attempts to fix the vulnerability by installing a safe version of xz-utils.
```bash
./CVE-2024-3094-checker.sh -r
```

## Refrences
- https://nvd.nist.gov/vuln/detail/CVE-2024-3094
- https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
- https://www.openwall.com/lists/oss-security/2024/03/29/4

File Snapshot


 [4.0K]  /data/pocs/29243a0ff8e5dd5c731c7118c70673353a64a787
├── [2.5K]  CVE-2024-3094-checker.sh
└── [1.4K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!