Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%

CVE-2024-3094 PoC — Xz: malicious code in distributed source

Source
Associated Vulnerability
Title:Xz: malicious code in distributed source (CVE-2024-3094)
Description:Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Readme
# xz-utils Vulnerability Check and Update Utility

This script is designed to check for vulnerabilities in the installed version of xz-utils on your system. If a vulnerable version is detected, the script offers to automatically download and install a stable version to mitigate potential security risks.

## Requirements

The following components are necessary for the script to run:
- Python 3
- `requests` library (can be installed via `pip install requests`)
- `tarfile` library (included with Python 3)
- Internet access for downloading the stable version archive

## Features

- Automatically detects the installed version of xz-utils.
- Checks against a list of known vulnerable versions.
- Downloads and installs a stable version if a vulnerable version is detected.
- Cleans up downloaded archives after installation.

## How to Use

1. Ensure Python 3 is installed on your system.
2. Clone this repository or download the script directly.
3. Install the required Python libraries using `pip install -r requirements.txt` (ensure you have `requests` library installed).
4. Run the script with `python check_xz_vulnerability.py`.
5. If a vulnerable version is detected, follow the prompts to install the stable version.

## Note

This script requires administrative privileges to install the new version of xz-utils. You may be prompted for your password if necessary.

## Disclaimer

This script is provided "as is", without warranty of any kind. Use it at your own risk. The authors are not responsible for any damage or issues that may arise from using this script.

## Contribution

Contributions are welcome. Please create a pull request or open an issue for any bugs or feature requests.

## License

This project is licensed under the MIT License - see the LICENSE file for details.
File Snapshot

[4.0K] /data/pocs/67ff71b929153970995213ba4d27585daafc5ec0 ├── [2.8K] CVE-2024-3094-checker.py ├── [1.8K] README.md └── [ 19] requirements.txt 0 directories, 3 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →