CVE-2023-35959

What it actually does

Multiple OS command injection vulnerabilities exist in the decompression functionality allowing arbitrary command execution when processing a specially crafted .ghw wave file.

Why it matters to the business

Attackers can achieve full system compromise on victim machines by delivering malicious files, increasing risk for organizations using the affected software with no ransomware association or known active campaigns.

How an attack unfolds

An attacker creates a malicious .ghw file embedding OS commands in the decompression path, delivers it to a target user, and achieves execution when the file is opened in the vulnerable application.

How to fix it

Update the affected software to a fixed version; for chromium on Debian 12 apply 126.0.6478.56-1~deb12u1 or later equivalent patches for the GTKWave component.

How to confirm the fix worked

Verify the installed version matches or exceeds the fixed release, test with known-good and crafted .ghw files in a lab environment, and confirm no command injection occurs on open.

Typical attack path

1. Craft a malicious .ghw file containing injected commands
2. Distribute the file via email, download, or shared storage
3. Victim opens the file in the affected application
4. Decompression triggers command execution

How to detect it

Review application logs and file access records for unexpected .ghw file opens, monitor process creation events for unusual commands spawned during file handling, and check for any post-exploitation artifacts from command execution.

What your security team should do

• Apply the listed fixed versions immediately due to public exploit availability
• Restrict opening of untrusted wave files until patched
• Monitor for new threat actor activity targeting this issue
• Scan environments for presence of the vulnerable version