PT-2024-16640 · Unknown · Didi Super-Jacoco

Gaogaostone · Published 2024-11-06 · Updated 2024-11-08 · CVE-2024-10919

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions didi Super-Jacoco version 1.0

Description A critical issue has been found in the software, affecting an unknown functionality of the file /cov/triggerUnitCover. The manipulation of the uuid argument leads to os command injection. This issue can be exploited remotely, potentially allowing system takeover. The exploit has been disclosed publicly.

Recommendations For didi Super-Jacoco version 1.0, patch immediately to prevent os command injection via the uuid parameter in the /cov/triggerUnitCover file. As a temporary workaround, consider restricting access to the /cov/triggerUnitCover file until a patch is available. Verify that there has been no unauthorized access to the system.

Exploit

Fix

Special Elements Injection

OS Command Injection

Weakness Enumeration

CWE-74

CWE-78

Related Identifiers

CVE-2024-10919

Affected Products

Didi Super-Jacoco

References · 10

• 🔥 https://github.com/didi/super-jacoco/issues/49 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-10919 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10919 · Vendor Advisory
• https://twitter.com/oktsec/status/1854126004064727432 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1854329731610493280 · Twitter Post
• https://vuldb.com/?submit.432689 · Note
• https://vuldb.com/?ctiid.283315 · Note
• https://twitter.com/CVEnew/status/1854197310315442600 · Twitter Post
• https://t.me/cvedetector/10013 · Telegram Post
• https://vuldb.com/?id.283315 · Note