2.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-58253

CVE-2024-58253: obfstr Type Confusion vulnerability

In the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversion that produces an invalid value.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-58253

CVE-2024-58253:

2.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
obfstr	rust	< 0.4.4	0.4.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a type confusion in the obfstr crate, specifically within the obfstr! macro. The analysis of commit b57034ced6df94329a7595a059d0fdb7332855d3 and the associated issue #60 reveals the following:

The obfstr! macro (defined in src/bytes.rs) did not enforce that its input argument was a string slice (&str) before calling the .as_bytes() method on it. This is evident from the patch, which adds ::core::convert::identity::<&str>() to coerce the input to a string slice.
If a non-string type that still provided an as_bytes() method was passed to obfstr!, the resulting byte array might not be valid UTF-8.
This potentially invalid byte array was then passed to the unsafe_as_str function (defined in src/lib.rs, as per issue #60, and called by obfstr!).
The unsafe_as_str function performs a direct, unchecked conversion from bytes to a string slice (core::str::from_utf8_unchecked). If the bytes are not valid UTF-8, this results in undefined behavior.

Therefore, obfstr! is vulnerable because it initiates the type confusion by improperly handling input. unsafe_as_str is the function where the consequence of this confusion (unsafe UTF-8 conversion on invalid bytes) occurs. Both would be involved in a runtime scenario where the vulnerability is triggered. The patch mitigates the vulnerability by ensuring obfstr! correctly prepares its input before it reaches unsafe_as_str.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.