PT-2024-32462 · Unknown+1 · Shields.Io+1

Nickcopi · Published 2024-09-26 · Updated 2024-09-30 · CVE-2024-47180

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shields.io versions prior to server-2024-09-25

Description The issue concerns a remote execution vulnerability via the JSONPath library used by the Dynamic JSON/Toml/Yaml badges. This vulnerability allows any user with access to make a request to a URL on the instance to execute code by crafting a malicious JSONPath expression. All users who self-host an instance are vulnerable. The problem was fixed in version server-2024-09-25.

Recommendations For versions prior to server-2024-09-25, update to server-2024-09-25 or later. As a temporary workaround, consider blocking access to the endpoints "/badge/dynamic/json", "/badge/dynamic/toml", and "/badge/dynamic/yaml" (e.g., via a firewall or reverse proxy in front of your instance) to prevent the exploitable endpoints from being accessed. For those who follow the rolling tag on DockerHub, update to the latest version by running docker pull shieldsio/shields:next.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2024-47180

GHSA-RXVX-X284-4445

Affected Products

Jsonpath

Shields.Io

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47180.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-47180 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47180 · Security Note
• https://github.com/badges/shields/pull/10551 · Note
• https://github.com/badges/shields/issues/10553 · Note
• https://github.com/badges/shields/security/advisories/GHSA-rxvx-x284-4445 · Note
• https://github.com/badges/shields/commit/ec1b6c8daccda075403c1688ac02603f7aaa50b2 · Note
• https://twitter.com/VulmonFeeds/status/1839451862371643847 · Twitter Post
• https://t.me/cvedetector/6458 · Telegram Post
• https://twitter.com/CVEnew/status/1839388866236526676 · Twitter Post