Command Injection Vulnerability in Rizin Framework

CVE-2024-53256

What is CVE-2024-53256?

The Rizin Framework, a UNIX-like reverse engineering toolset, contains a vulnerability stemming from an insecure code snippet in rizin.c related to command execution. Specifically, the vulnerable code allows an attacker to exploit user-defined binary class attributes, enabling the execution of a malicious binary if certain conditions are met. When rclass is set to fs, it can trigger malicious behavior if it interacts with a crafted binary containing defined bclass attributes. This vulnerability is addressed in version 0.7.4 and emphasizes the importance of updating to the latest version to mitigate potential exploits.

References