CVE-2024-28189
Vulnerability from cvelistv5
Published
2024-04-18 14:40
Modified
2024-08-02 00:48
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it's own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1.
References
security-advisories@github.comhttps://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232
security-advisories@github.comhttps://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd
security-advisories@github.comhttps://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg
security-advisories@github.comhttps://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf
af854a3a-2127-422b-91ae-364da2661108https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232
af854a3a-2127-422b-91ae-364da2661108https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd
af854a3a-2127-422b-91ae-364da2661108https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg
af854a3a-2127-422b-91ae-364da2661108https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf
Impacted products
Vendor Product Version
judge0 judge0 Version: <= 1.13.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:judge0:judge0:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "judge0",
            "vendor": "judge0",
            "versions": [
              {
                "lessThanOrEqual": "1.13.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28189",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-07T19:38:56.803559Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-07T19:40:09.558Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:48:49.514Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg"
          },
          {
            "name": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf"
          },
          {
            "name": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd"
          },
          {
            "name": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "judge0",
          "vendor": "judge0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it\u0027s own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-18T14:40:29.320Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg"
        },
        {
          "name": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf"
        },
        {
          "name": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd"
        },
        {
          "name": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232"
        }
      ],
      "source": {
        "advisory": "GHSA-3xpw-36v7-2cmg",
        "discovery": "UNKNOWN"
      },
      "title": "Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Link"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-28189",
    "datePublished": "2024-04-18T14:40:29.320Z",
    "dateReserved": "2024-03-06T17:35:00.859Z",
    "dateUpdated": "2024-08-02T00:48:49.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-28189\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-04-18T15:15:29.480\",\"lastModified\":\"2024-11-21T09:05:59.537\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it\u0027s own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1.\"},{\"lang\":\"es\",\"value\":\"Judge0 es un sistema de ejecuci\u00f3n de c\u00f3digo en l\u00ednea de c\u00f3digo abierto. La aplicaci\u00f3n utiliza el comando chown de UNIX en un archivo que no es de confianza dentro del entorno limitado. Un atacante puede abusar de esto creando un enlace simb\u00f3lico (enlace simb\u00f3lico) a un archivo fuera del entorno sandbox, lo que le permite ejecutar chown en archivos arbitrarios fuera del entorno sandbox. Esta vulnerabilidad no tiene un impacto por s\u00ed sola, pero se puede utilizar para omitir el parche CVE-2024-28185 y obtener un escape completo de la zona de pruebas. Esta vulnerabilidad se solucion\u00f3 en 1.13.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-59\"},{\"lang\":\"en\",\"value\":\"CWE-61\"}]}],\"references\":[{\"url\":\"https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Link\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-61\", \"lang\": \"en\", \"description\": \"CWE-61: UNIX Symbolic Link (Symlink) Following\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-59\", \"lang\": \"en\", \"description\": \"CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg\"}, {\"name\": \"https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf\"}, {\"name\": \"https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd\"}, {\"name\": \"https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232\"}], \"affected\": [{\"vendor\": \"judge0\", \"product\": \"judge0\", \"versions\": [{\"version\": \"\u003c= 1.13.0\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-04-18T14:40:29.320Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it\u0027s own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1.\"}], \"source\": {\"advisory\": \"GHSA-3xpw-36v7-2cmg\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-28189\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-07T19:38:56.803559Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:judge0:judge0:*:*:*:*:*:*:*:*\"], \"vendor\": \"judge0\", \"product\": \"judge0\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.13.0\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-07T19:40:03.954Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-28189\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2024-03-06T17:35:00.859Z\", \"datePublished\": \"2024-04-18T14:40:29.320Z\", \"dateUpdated\": \"2024-06-07T19:40:09.558Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.