System.Linq.Dynamic.Core 1.0.7.10-1.2.25 - Remote Code Execution via Untrusted Input Parsing
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2023-32571. PoCs published by Tris0n, SecTex, vert16x.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2023-32571, demonstrating a Dynamic LINQ injection vulnerability that leads to remote code execution (RCE) by invoking C# methods through reflection. The exploit leverages the `System.Diagnostics.Process.Start` method to execute arbitrary commands on the target system.
Description
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.
Exploits (3)
This repository contains a proof-of-concept exploit for CVE-2023-32571, demonstrating a Dynamic LINQ injection vulnerability that leads to remote code execution (RCE) by invoking C# methods through reflection. The exploit leverages the `System.Diagnostics.Process.Start` method to execute arbitrary commands on the target system.
This repository contains a functional proof-of-concept exploit for CVE-2023-32571, leveraging a vulnerability in System.Linq.Dynamic.Core to achieve remote code execution via dynamic LINQ expression parsing. The exploit supports two modes: AssemblyLoad (for loading arbitrary .NET assemblies) and ProcessStart (for executing system commands).
This repository contains a proof-of-concept exploit for CVE-2023-32571, demonstrating a Dynamic LINQ injection vulnerability that leads to remote code execution (RCE) by invoking C# methods through reflection. The exploit leverages the `System.Diagnostics.Process.Start` method to execute arbitrary commands on the target system.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H