CVE-2024-3094

Summary

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Sources

• xz-cve-2024-3094Research

  XZ Backdoor Extract(Test on Ubuntu 23.10)

• xzbotExploit

  notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

• CVE-2024-3094Detection

  Shell script to detect if the ssh binary is likely vulnerable to CVE-2024-3094, without requiring hexdump.

• ludus_xz_backdoorExploit

  An Ansible Role that installs the xz backdoor (CVE-2024-3094) on a Debian host and optionally installs the xzbot tool.

• xz_cve-2024-3094_detectionDetection

  Script to detect CVE-2024-3094.

• CVE-2024-3094-infoInformational

  Information for CVE-2024-3094

• CVE-2024-3094PoC

  Proof-of-concept and analysis tools for CVE-2024-3094, the XZ Utils backdoor vulnerability, including detection and exploitation scripts.

• CVE-2024-3094-XZ-Backdoor-DetectorDetection

  Shell script to detect the CVE-2024-3094 backdoor in XZ Utils by checking for malicious code in liblzma build artifacts and identifying affected versions.

• CVE-2024-3094Research

  Research of CVE-2024-3094 vulnerability.

• CVE-2024-3094-checkerDetection

  Quick and dirty PoC for checking whether a vulnerable version of xz-utils is installed (CVE-2024-3094)

• Detectar-Backdoor-en-liblzma-de-XZ-utils-CVE-2024-3094-Detection

  Regla YARA para detectar el backdoor de liblzma en XZ Utils 5.6.0/5.6.1 (CVE-2024-3094).

• CVE-2024-3094PoC

  Educational lab replicating the XZ Utils backdoor (CVE-2024-3094) with a custom Ed448 key pair. Includes a patched liblzma, systemd service, and exploit client for authorized security research.

• CVE-2024-3094-checkerDetection

  Bash script to detect and remediate CVE-2024-3094, a critical supply-chain vulnerability in the XZ Utils library, with automatic safe version installation.

• CVE-2024-3094Informational

  Advisory and analysis repository for CVE-2024-3094, detailing a critical backdoor in Linux SSH library with mitigation steps for servers and Android devices.

• CVE-2024-3094Informational

  Minimal CVE-2024-3094 reference repository documenting the xz backdoor vulnerability, affected versions (5.6.0/5.6.1), and mitigation steps. Includes a checker script and links to technical analysis.

• CVE-2024-3094-backdoor-env-containerResearch

  This is a container environment running CVE-2024-3094 sshd backdoor instance, working with https://github.com/amlweems/xzbot project. IT IS NOT Docker, just implemented by chroot.

• cs50-cybersecurity-final-projectResearch

  Technical analysis of the XZ Utils backdoor (CVE-2024-3094), explaining the supply chain attack, obfuscation techniques, and impact on OpenSSH via liblzma.

• writeup-CVE-2024-3094Research

  Technical analysis and writeup of CVE-2024-3094, the XZ Utils backdoor. Explores the supply-chain attack, exploitation mechanics, and detection indicators.

• xz-utils-backdoor-case-studyResearch

  Technical case study of the XZ Utils backdoor (CVE-2024-3094), covering supply-chain trust abuse, malicious release artifacts, build-stage injection, sshd dependency abuse, detection engineering and Red Team lessons.

• CVE-2024-3094Detection

  Shell scripts to detect CVE-2024-3094 backdoor in liblzma5 across Kubernetes pods and Docker containers, with SBOM generation via Trivy for supply-chain vulnerability scanning.

• CVE-2024-3094-infoInformational

  Curated collection of resources and analysis documenting the CVE-2024-3094 supply-chain backdoor in XZ Utils, including security advisories, technical write-ups, and detection links.

• XZ-Utils_CVE-2024-3094Research

  XZ-Utils工具库恶意后门植入漏洞(CVE-2024-3094)

• CVE-2024-3094Research

  CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components.

• cs50-cybersecurity-final-projectResearch

  CS50 Cybersecurity Final Project - Analysis of CVE-2024-3094

• xzwhyPoC

  XZ Utils CVE-2024-3094 POC for Kubernetes

• Report-XZ-Utils-CVE-2024-3094Informational

  Hello,

• xzk8sPoC

  Dockerfile and Kubernetes manifests for reproduce CVE-2024-3094

• CVE-2024-3094PoC

  Basic POC to test CVE-2024-3094 vulnerability inside K8s cluster

• Kaspersky_CVE-2024-3094Research

  Security review of CVE-2024-3094 (XZ Utils backdoor) including threat modeling, static/dynamic code analysis, fuzzing with AFL++, and a proof-of-concept exploit. Includes Docker environment for reproducible analysis.

• sec_review_cve-2024-3094Research

  Security review уязвимости CVE-2024-3094 с открытым исходным кодом

• CVE-2024-3094-checkDetection

  Shell script to detect CVE-2024-3094 (xz-utils backdoor) on Linux and macOS systems, with automated check and fix instructions.

• CVE-2024-3094Detection

  A script to detect if xz is vulnerable - CVE-2024-3094

• CVE-2024-3094Informational

  Obsidian notes about CVE-2024-3094

• threat-intel-cve-2024-3094Informational

  Threat intelligence report analyzing the xz-utils backdoor vulnerability (CVE-2024-3094)

• CVE-2024-3094Informational

  CVE-2024-3094

• CVE-2024-3094PoC

  CVE-2024-3094 실습 환경 구축 및 보고

• CVE-2024-3094Exploit

  Exploit code for CVE-2024-3094, a critical vulnerability in XZ Utils, demonstrating the backdoor and its exploitation.

• cve-2024-3094-analysisExploit

  Analysis and exploitation toolkit for CVE-2024-3094, providing vulnerability assessment and proof-of-concept execution for the targeted security flaw.

• CVE-2024-3094PoC

  Proof-of-concept exploit for CVE-2024-3094, demonstrating the vulnerability and providing a basis for security testing and mitigation analysis.

• CVE-2024-3094Detection

  Detectar CVE-2024-3094

• CVE-2024-3094-fix-exploitsExploit

  Collection of Detection, Fix, and exploit for CVE-2024-3094

• CVE-2024-3094-Nmap-NSE-scriptExploit

  Nmap NSE script to detect and exploit CVE-2024-3094, a critical vulnerability in XZ Utils, enabling remote code execution via SSH.

• xzutils_backdoor_obfuscationPoC

  Script to obfuscate a payload the same way as it was done by the XZ utils attack (CVE-2024-3094)

• cve-2024-3094PoC

  A XZ backdoor vulnerability explained in details

• CVE-2024-3094PoC

  Exploit or analysis tool for CVE-2024-3094, a critical vulnerability in XZ Utils. Provides proof-of-concept or detection capabilities for affected systems.