Panther high experimental python

A backdoored version of XZ or liblzma is vulnerable to CVE-2024-3094

Detects vulnerable versions of XZ and liblzma on Linux and MacOS using Osquery logs. Versions 5.6.0 and 5.6.1 of xz and liblzma are most likely vulnerable to backdoor exploit. Vuln management pack must be enabled: https://github.com/osquery/osquery/blob/master/packs/vuln-management.conf

View Source

Detection Logic

QUERY_NAMES = {
    "pack_vuln-management_homebrew_packages",
    "pack_vuln-management_deb_packages",
    "pack_vuln-management_rpm_packages",
}
VULNERABLE_PACKAGES = {"xz", "liblzma", "xz-libs", "xz-utils"}
VULNERABLE_VERSIONS = {"5.6.0", "5.6.1"}


def rule(event):
    package = event.deep_get("columns", "name", default="")
    version = event.deep_get("columns", "version", default="")
    return all(
        [
            event.get("name") in QUERY_NAMES,
            (package in VULNERABLE_PACKAGES or package.startswith("liblzma")),
            any(version.startswith(v) for v in VULNERABLE_VERSIONS),
        ]
    )


def title(event):
    host = event.get("hostIdentifier")
    name = event.deep_get("columns", "name", default="")
    version = event.deep_get("columns", "version", default="")
    return f"[CVE-2024-3094] {name} {version} Potentially vulnerable on {host}"

Field Validations

Loading…

Comments (0)

Loading comments...