PT-2024-24090 · Unknown · Gin-Vue-Admin

Highpixelmaxqm · Published 2024-04-09 · Updated 2024-05-20 · CVE-2024-31457

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions gin-vue-admin versions 2.6.1 and earlier

Description The issue is a code injection vulnerability in the backend of gin-vue-admin, specifically in the Plugin System -> Plugin Template feature. An attacker can perform directory traversal by manipulating the plugName parameter, allowing them to create specific folders and insert arbitrary code into Go files within those folders. The vulnerability exists due to the controllability of the plugName field within the struct.

Recommendations For gin-vue-admin version 2.6.1, update to a version that contains the patch for this issue, specifically pseudoversion 0.0.0-20240409100909-b1b7427c6ea6 or later. As a temporary workaround for versions prior to the fixed version, consider using a filtering method to rectify the directory traversal problem, such as checking for the presence of ".." in the plugPath variable.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-31457

GHSA-GV3W-M57P-3WC4

GO-2024-2702

Affected Products

Gin-Vue-Admin

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31457.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-31457 · Security Note
• https://osv.dev/vulnerability/GHSA-gv3w-m57p-3wc4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31457 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2702 · Vendor Advisory
• https://github.com/flipped-aurora/gin-vue-admin · Note
• https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-gv3w-m57p-3wc4 · Note
• https://github.com/flipped-aurora/gin-vue-admin/commit/b1b7427c6ea6c7a027fa188c6be557f3795e732b · Note
• https://github.com/flipped-aurora/gin-vue-admin/blob/746af378990ebf3367f8bb3d4e9684936df152e7/server/api/v1/system/sys_auto_code.go:239 · Note
• https://t.me/cvenotify/76217 · Telegram Post
• https://pkg.go.dev/github.com/flipped-aurora/gin-vue-admin/server?tab=versions · Note