Skip to content

Back to the catalog

Trail of Bits (@trailofbits) on X
x.comthread

Trail of Bits (@trailofbits) on X

Trail of Bits post says it achieved remote code execution through a Brotli decoder bug in Linux lab setups: Node.js 24.22.0 with Express 5.3.0 via the standard JSON parser (x86-64 and ARM64), and Electron 41.10.7 (x86-64) with a custom decoding service. Exploitation needs a carefully matched setup and repeated attempts. A scanner by ToBScottA finds hidden copies of the decoder, including in stripped binaries.

TL;DR Trail of Bits reports lab RCE via a Brotli decoder bug in Node.js/Express and Electron, and releases a scanner for hidden Brotli copies.
Open original ↗

Organisations named here

  • ToBScottA

Technologies named here

  • Brotli
  • Node.js
  • Express
  • Electron
  • Trail of Bits
  • Brotli decoder (including hidden copies in stripped binaries)
  • Brotli decoder scanner (github.com/trailofbits/br…)

Techniques named here

  • Detection of embedded library copies in stripped binaries
  • Remote code execution via Brotli decoding bug

Related in AppSec