PT-2024-22322 · Judge0 · Judge0

Stacksparrow4 · Published 2024-04-18 · Updated 2024-05-02 · CVE-2024-28189

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Judge0 versions prior to 1.13.1

Description The issue arises from the application's use of the UNIX chown command on an untrusted file within the sandbox. An attacker can exploit this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This can be used to bypass a previous patch and obtain a complete sandbox escape.

Recommendations For versions prior to 1.13.1, update to version 1.13.1 to resolve the issue. As a temporary workaround, consider restricting the use of the chown command within the sandbox until the update is applied.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-61

CWE-59

Related Identifiers

CVE-2024-28189

GHSA-3XPW-36V7-2CMG

GHSA-H9G2-45C8-89CF

Affected Products

Judge0

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/judge0_sandbox_escape_cve_2024_28189.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28189.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-28189 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28189 · Security Note
• https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg · Note
• https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232 · Note
• https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf · Note
• https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd · Note
• https://twitter.com/CVEnew/status/1781029358901104747 · Twitter Post
• https://t.me/rnetsec/20310 · Telegram Post
• https://twitter.com/Dinosn/status/1784866521560355100 · Twitter Post
• https://t.me/pentestingnews/46189 · Telegram Post
• https://twitter.com/yeletech/status/1786027652869968262 · Twitter Post
• https://t.me/defcon_news/123196 · Telegram Post
• https://twitter.com/XynikIT/status/1785364393569476697 · Twitter Post