CVE-2024-36587

HIGH

DNSCrypt-proxy <2.1.5 - Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-36587. PoCs published by meeeeing.

AI-analyzed exploit summary This repository demonstrates a local privilege escalation (LPE) vulnerability in dnscrypt-proxy (CVE-2024-36587) via binary planting. The Dockerfile sets up an environment where a malicious 'id' binary is planted and executed during service installation, proving the exploit.

Description

Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting the binary dnscrypt-proxy.

Exploits (1)

nomisec WORKING POC

by meeeeing · poc

https://github.com/meeeeing/CVE-2024-36587

View Code ZIP pw:eip

This repository demonstrates a local privilege escalation (LPE) vulnerability in dnscrypt-proxy (CVE-2024-36587) via binary planting. The Dockerfile sets up an environment where a malicious 'id' binary is planted and executed during service installation, proving the exploit.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Trivial

Reliability

Reliable

Target: dnscrypt-proxy v2.0.0-alpha9 to v2.1.5

No auth needed

Prerequisites: Docker environment · dnscrypt-proxy service installation

MITRE ATT&CK

T1548.001 - Setuid and Setgid

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1

Core References

Various Sources

https://github.com/go-compile/security-advisories/blob/master/vulns/CVE-2024-36587.md

View Writeup ZIP pw:eip

Scores

CVSS v3 7.8

EPSS 0.0017

EPSS Percentile 7.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-266

Status published

Published Jun 13, 2024

Tracked Since Feb 18, 2026