PT-2024-22318 · Judge0 · Judge0

Stacksparrow4 · Published 2024-04-18 · Updated 2024-05-02 · CVE-2024-28185

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Judge0 (affected versions not specified)

Description The issue concerns an open-source online code execution system. It does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, the system writes a run script to the sandbox directory. An attacker can create a symbolic link (symlink) at the path run script before this code is executed, resulting in the f.write writing to an arbitrary file on the unsandboxed system. This can be used to overwrite scripts on the system and gain code execution outside of the sandbox.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Weakness Enumeration

CWE-61

CWE-59

Related Identifiers

CVE-2024-28185

GHSA-H9G2-45C8-89CF

Affected Products

Judge0

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/judge0_sandbox_escape_cve_2024_28189.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28185.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-28185 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28185 · Vendor Advisory
• https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L197-L201 · Note
• https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf · Note
• https://github.com/judge0/judge0/commit/846d5839026161bb299b7a35fd3b2afb107992fc · Note
• https://twitter.com/CVEnew/status/1781029360046104885 · Twitter Post
• https://t.me/rnetsec/20310 · Telegram Post
• https://twitter.com/Dinosn/status/1784866521560355100 · Twitter Post
• https://t.me/pentestingnews/46189 · Telegram Post
• https://twitter.com/yeletech/status/1786027652869968262 · Twitter Post
• https://t.me/defcon_news/123196 · Telegram Post
• https://twitter.com/vuldb/status/1781039004487733295 · Twitter Post
• https://twitter.com/XynikIT/status/1785364393569476697 · Twitter Post