CVE-2024-39844

What it actually does

A flaw in the modtcl module allows remote attackers to execute arbitrary code by sending a specially crafted KICK command to an IRC network managed by ZNC.

Why it matters to the business

Attackers could gain full control over the ZNC IRC bouncer, potentially accessing user communications, credentials, or using the server for further attacks.

How an attack unfolds

An attacker connects to a ZNC instance with modtcl enabled and sends a KICK command containing malicious TCL code that gets executed due to insufficient input sanitization.

How to fix it

Upgrade ZNC to the version containing commit ae353acf2fe61b50fb1a6617824c334a0bf22a4f or later, which is version 1.9.1 or newer.

How to confirm the fix worked

Verify the installed ZNC version is 1.9.1 or higher and check that modtcl is updated or disabled if not needed.

Typical attack path

1. Identify ZNC server with modtcl loaded
2. Craft and send malicious KICK IRC command
3. Execute arbitrary code on the server

How to detect it

Review ZNC logs for suspicious KICK commands or unexpected process executions triggered by the modtcl module.

What your security team should do

• Update ZNC to the latest fixed version immediately
• Disable modtcl if not required
• Monitor for unusual IRC commands