CVE-2023-33965
📋 TL;DR
CVE-2023-33965 is a command injection vulnerability in Brook's tproxy server that allows remote code execution. Attackers can exploit this by tricking victims into visiting malicious web pages that trigger requests to the local tproxy service. Users running vulnerable versions of Brook are affected.
💻 Affected Systems
- Brook
📦 What is this software?
Brook by Txthinking
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Remote code execution allowing attackers to run arbitrary commands on the victim's system, potentially installing malware, stealing credentials, or creating backdoors.
If Mitigated
No impact if the vulnerability is patched or if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious webpage) but the technical complexity is low once the user is tricked.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20230606
Vendor Advisory: https://github.com/txthinking/brook/security/advisories/GHSA-vfrj-fv6p-3cpf
Restart Required: Yes
Instructions:
1. Download Brook version 20230606 or later from the official repository. 2. Stop the running Brook service. 3. Replace the vulnerable binary with the patched version. 4. Restart the Brook service.
🔧 Temporary Workarounds
Disable tproxy server
allDisable the vulnerable tproxy server component if not required
Stop the Brook service and ensure tproxy is not enabled in configuration
Network isolation
allRestrict network access to the tproxy service
Configure firewall rules to block external access to the tproxy port (default 1080)
🧯 If You Can't Patch
- Disable the tproxy server functionality entirely
- Implement strict network segmentation and firewall rules to isolate the vulnerable service
🔍 How to Verify
Check if Vulnerable:
Check if Brook version is older than 20230606 and if tproxy server is enabled in configurationCheck Version:
brook --version or check the binary version informationVerify Fix Applied:
Verify Brook version is 20230606 or newer and test that tproxy functionality works without allowing command injection📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from Brook process
- Suspicious network requests to tproxy service
Network Indicators:
- Unexpected HTTP requests to local tproxy service from browser processes
- Command injection patterns in network traffic
SIEM Query:
process_name="brook" AND (command_line CONTAINS "bash" OR command_line CONTAINS "sh" OR command_line CONTAINS "cmd")🔗 References
- https://github.com/txthinking/brook/commit/314d7070c37babf6c38a0fe1eada872bb74bf03e
- https://github.com/txthinking/brook/security/advisories/GHSA-vfrj-fv6p-3cpf
- https://github.com/txthinking/brook/commit/314d7070c37babf6c38a0fe1eada872bb74bf03e
- https://github.com/txthinking/brook/security/advisories/GHSA-vfrj-fv6p-3cpf
