研究人员发现OBS Studio存在一条严重漏洞链，使攻击者能够通过单条Twitch聊天消息在直播主的计算机上实现远程代码执行 1。这一漏洞链由三个关键因素组成：聊天悬浮窗中的跨站脚本（XSS）漏洞、OBS中被禁用的Chromium沙箱保护，以及V8引擎的类型混淆漏洞CVE-2024-7971 1。
漏洞涉及OBS Studio 32.2.2在Windows 11环境中运行，其中Chromium版本为127.0.6533.120，V8版本为12.7.224.18 1。CVE-2024-7971影响Chromium 128.0.6613.84之前的版本，已被朝鲜黑客组织Citrine Sleet在野利用 1。OBS的浏览器集成框架（CEF）配置中存在settings.no_sandbox = true设置，导致沙箱保护被关闭 1。
OBS团队已启动修复工作，其中PR #523已于9月10日合并至obs-browser项目，PR #13890已于9月17日合并至obs-studio主项目 1。
Researchers have uncovered a severe vulnerability chain in OBS Studio that enables attackers to achieve remote code execution on a streamer's computer through a single Twitch chat message.1 The exploit chain comprises three distinct components: an insecure cross-site scripting (XSS) vulnerability in the chat overlay feature, disabled Chromium sandbox protections within OBS, and a type confusion vulnerability (CVE-2024-7971) in the V8 engine.1
The vulnerability specifically affects OBS Studio 32.2.2 running on Windows 11, which uses Chromium version 127.0.6533.120 and V8 version 12.7.224.18.1 The underlying CVE-2024-7971 type confusion flaw impacts Chromium versions prior to 128.0.6613.84 and has already been exploited in the wild by the North Korean hacking group Citrine Sleet.1 A critical factor enabling the attack is OBS's browser configuration setting that disables sandbox protection, specified as settings.no_sandbox = true in the Chromium Embedded Framework (CEF) implementation.1
The OBS development team has already begun implementing fixes for the vulnerability.1 A pull request addressing the browser component (PR #523) was merged into obs-browser on September 10, while a second pull request to re-enable sandbox protections (PR #13890) was merged into obs-studio on September 17.1
评论
还没有评论，欢迎留下第一条。