PT-2024-31565 · Overleaf · Overleaf Server Pro

Stefan-Schiller-Sonarsource · Published 2024-09-02 · Updated 2024-09-25 · CVE-2024-45313

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Overleaf Server Pro versions prior to 2024-07-17 Overleaf Server Pro using legacy docker-compose.yml versions prior to 2024-08-28

Description Overleaf is a web-based collaborative LaTeX editor. When installing Server Pro using the Overleaf Toolkit from before 2024-07-17 or legacy docker-compose.yml from before 2024-08-28, the configuration for LaTeX compiles was insecure by default. This required the administrator to enable the security features via a configuration setting (SIBLING CONTAINERS ENABLED in Toolkit, SANDBOXED COMPILES in legacy docker-compose/custom deployments). If these security features are not enabled, users have access to the sharelatex container resources (filesystem, network, environment variables) when running compiles, leading to multiple file access vulnerabilities, either directly or via symlinks created during compiles.

Recommendations For existing installations using the previous default setting, migrate to using sibling containers. Set SIBLING CONTAINERS ENABLED=true in config/overleaf.rc as a mitigation. In legacy docker-compose/custom deployments, use SANDBOXED COMPILES=true.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-1188

Related Identifiers

CVE-2024-45313

GHSA-M95Q-G8QG-WGJ4

Affected Products

Overleaf Server Pro

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45313.json · Exploit
• https://github.com/overleaf/overleaf/security/advisories/GHSA-m95q-g8qg-wgj4 · Vendor Advisory
• https://github.com/overleaf/toolkit/commit/7a8401897b24777b47338452ff8d12e2fb6dd5ff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-45313 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45313 · Vendor Advisory
• https://github.com/overleaf/overleaf/wiki/Server-Pro:-Sandboxed-Compiles · Note
• https://github.com/overleaf/toolkit/blob/master/doc/sandboxed-compiles.md#enabling-sibling-containers · Note
• https://twitter.com/VulmonFeeds/status/1830711473275908181 · Twitter Post
• https://t.me/cvenotify/93010 · Telegram Post
• https://t.me/cvedetector/4645 · Telegram Post
• https://twitter.com/CVEnew/status/1830655316045742275 · Twitter Post
• https://t.me/cvenotify/96027 · Telegram Post
• https://twitter.com/oktsec/status/1830685695976878509 · Twitter Post