Threat Investigation
Request a demo

CVE-2023-33965

Critical

Description

Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local `tproxy` service leading to remote code execution. A patch is available in version 20230606.

SeverityCritical
CVSS9.6
Exploit probability—
ProductTxthinking Brook
PublishedJun 1, 2023
First seenJun 1, 2023
Weakness typeCWE-78OS command injection

How to fix

Update
  • txthinking brook20230606 or later
  • github.com/txthinking/brook20230606 or later

Affected products

ProductAffected versionsFixed in
txthinking brookv < 2023060620230606
github.com/txthinking/brookGov < 2023060620230606

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.