Chaos Mesh 未授权 命令注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover
• https://nvd.nist.gov/vuln/detail/CVE-2025-59361
• https://thehackernews.com/2025/09/chaos-mesh-critical-graphql-flaws.html
• https://www.chnhonker.com/4579.html
• https://cn-sec.com/archives/4488616.html
• https://github.com/chaos-mesh/chaos-mesh/pull/4702
• https://nvd.nist.gov/vuln/detail/CVE-2025-59359
• https://gbhackers.com/chaos-mesh-critical-vulnerabilities/
• https://www.knowsafe.com/ti/info/0/1000788
• https://zeropath.com/blog/cve-2025-59361-chaos-mesh-command-injection

Related Vulnerabilities

• Chaos Mesh killProcesses 未授权 命令注入漏洞
• Chaos Mesh cleanIptables 未授权 命令注入漏洞
• Chaos Mesh 访问控制不当漏洞
• （CVE-2025-8791）LitmusChaos Litmus role参数不恰当授权漏洞
• （CVE-2025-8792）LitmusChaos Litmus服务端安全控制绕过漏洞
• （CVE-2025-8794）LitmusChaos Litmus授权绕过漏洞
• （CVE-2025-8793）LitmusChaos Litmus项目ID参数不当控制漏洞
• PoCCVE-2023-47105: Chaosblade < 1.7.4 - Remote Code Execution
• PoCCVE-2024-31839: CHAOS 5.0.1 'sendCommandHandler' - Cross-Site Scripting
• Chaos RAT 远程代码执行漏洞