PT-2024-38260 · Anji Plus · Anji-Plus Aj-Report

Published 2024-08-02 · Updated 2025-11-20 · CVE-2024-7314

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions anji-plus AJ-Report versions <= 1.4.0

Description The issue allows a remote and unauthenticated attacker to bypass authentication by appending ";swagger-ui" to HTTP requests, potentially executing arbitrary Java on the victim server. This is due to improper handling of insufficient permissions via the /swagger-ui endpoint.

Recommendations For anji-plus AJ-Report versions <= 1.4.0, upgrade immediately to mitigate the risk of remote exploit. As a temporary workaround, consider restricting access to the /swagger-ui endpoint to minimize the risk of exploitation.

Exploit

Fix

RCE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

CWE-280

Related Identifiers

CVE-2024-7314

Affected Products

Anji-Plus Aj-Report

References · 13

• 🔥 https://github.com/vulhub/vulhub/tree/master/aj-report/CNVD-2024-15077 · Exploit
• 🔥 https://github.com/yuebusao/AJ-REPORT-EXPLOIT · Exploit
• 🔥 https://xz.aliyun.com/t/14460 · Exploit
• https://osv.dev/vulnerability/CVE-2024-7314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7314 · Security Note
• https://gitee.com/anji-plus/report/pulls/166/files · Patch
• https://t.me/cveNotify/143463 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1908112319231713428 · Twitter Post
• https://vulncheck.com/advisories/aj-report-swagger · Note
• https://twitter.com/oktsec/status/1823453027501592866 · Twitter Post
• https://t.me/cveNotify/143508 · Telegram Post
• https://t.me/cvedetector/2356 · Telegram Post
• https://t.me/cvenotify/94936 · Telegram Post