PT-2019-15166 · Jnoj · Jiangnan Online Judge

Publicado 2019-10-10 · Atualizado 2019-10-16 · CVE-2019-17490

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge (aka jnoj) version 0.8.0

Description The issue allows for arbitrary file upload. This can be achieved by uploading PHP code with a .php filename but setting the content type to image/png, and sending it to the "web/polygon/problem/tests" API endpoint.

Recommendations For Jiangnan Online Judge (aka jnoj) version 0.8.0, consider disabling the file upload functionality in the ProblemController until a patch is available. Restrict access to the "web/polygon/problem/tests" API endpoint to minimize the risk of exploitation. Avoid allowing uploads with mismatched file extensions and content types.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-17490

Produtos afetados

Jiangnan Online Judge

Referências · 3

• 🔥 https://github.com/shi-yang/jnoj/issues/51 · Exploit
• https://osv.dev/vulnerability/CVE-2019-17490 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-17490 · Nota de Segurança