PT-2024-27183 · Jan · Jan

Published 2024-06-04 · Updated 2025-06-15 · CVE-2024-36858

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jan version 0.4.12

Description An arbitrary file upload vulnerability in the "/v1/app/writeFileSync" interface allows attackers to execute arbitrary code via uploading a crafted file. The writeFileSync interface is vulnerable, and attackers can exploit this by uploading a malicious file.

Recommendations For Jan version 0.4.12, consider upgrading to version 0.5.2 or later, where this vulnerability has been patched. As a temporary workaround, consider restricting access to the "/v1/app/writeFileSync" interface to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-36858

GHSA-QFJH-MVQ6-C5P8

Affected Products

Jan

References · 9

• 🔥 https://github.com/HackAllSec/CVEs/tree/main/Jan%20Arbitrary%20File%20Upload%20vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2024-36858 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qfjh-mvq6-c5p8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36858 · Security Note
• https://github.com/janhq/jan/pull/3152 · Note
• https://github.com/janhq/jan · Note
• https://t.me/cvenotify/82796 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1934234447488188574 · Twitter Post
• https://t.me/cvenotify/82063 · Telegram Post