Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by judge0
CVE-2024-29021 (GCVE-0-2024-29021)
Vulnerability from cvelistv5 – Published: 2024-04-18 14:43 – Updated: 2024-08-02 01:03
VLAI
Title
SSRF into Sandbox Escape through Unsafe Default Configuration
Summary
Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/judge0/judge0/security/advisor… | x_refsource_CONFIRM |
| https://github.com/judge0/judge0/blob/ad66f77b131… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:judge0:judge0:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29021",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-20T03:28:23.555484Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:57:28.371Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:03:51.554Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-q7vg-26pg-v5hr",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-q7vg-26pg-v5hr"
},
{
"name": "https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L203-L230",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L203-L230"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.13.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1393",
"description": "CWE-1393: Use of Default Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-18T14:43:33.770Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-q7vg-26pg-v5hr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-q7vg-26pg-v5hr"
},
{
"name": "https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L203-L230",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L203-L230"
}
],
"source": {
"advisory": "GHSA-q7vg-26pg-v5hr",
"discovery": "UNKNOWN"
},
"title": "SSRF into Sandbox Escape through Unsafe Default Configuration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-29021",
"datePublished": "2024-04-18T14:43:33.770Z",
"dateReserved": "2024-03-14T16:59:47.611Z",
"dateUpdated": "2024-08-02T01:03:51.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28189 (GCVE-0-2024-28189)
Vulnerability from cvelistv5 – Published: 2024-04-18 14:40 – Updated: 2024-08-02 00:48
VLAI
Title
Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Link
Summary
Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it's own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/judge0/judge0/security/advisor… | x_refsource_CONFIRM |
| https://github.com/judge0/judge0/security/advisor… | x_refsource_MISC |
| https://github.com/judge0/judge0/commit/f3b8547b3… | x_refsource_MISC |
| https://github.com/judge0/judge0/blob/v1.13.0/app… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:judge0:judge0:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"lessThanOrEqual": "1.13.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28189",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-07T19:38:56.803559Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-07T19:40:09.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:48:49.514Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg"
},
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf"
},
{
"name": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd"
},
{
"name": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.13.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it\u0027s own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-18T14:40:29.320Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg"
},
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf"
},
{
"name": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd"
},
{
"name": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232"
}
],
"source": {
"advisory": "GHSA-3xpw-36v7-2cmg",
"discovery": "UNKNOWN"
},
"title": "Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Link"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-28189",
"datePublished": "2024-04-18T14:40:29.320Z",
"dateReserved": "2024-03-06T17:35:00.859Z",
"dateUpdated": "2024-08-02T00:48:49.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28185 (GCVE-0-2024-28185)
Vulnerability from cvelistv5 – Published: 2024-04-18 14:31 – Updated: 2024-08-02 00:48
VLAI
Title
Judge0 vulnerable to Sandbox Escape via Symbolic Link
Summary
Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a `run_script` to the sandbox directory. The security issue is that an attacker can create a symbolic link (symlink) at the path `run_script` before this code is executed, resulting in the `f.write` writing to an arbitrary file on the unsandboxed system. An attacker can leverage this vulnerability to overwrite scripts on the system and gain code execution outside of the sandbox.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/judge0/judge0/security/advisor… | x_refsource_CONFIRM |
| https://github.com/judge0/judge0/commit/846d58390… | x_refsource_MISC |
| https://github.com/judge0/judge0/blob/v1.13.0/app… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:judge0:judge0:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"lessThanOrEqual": "1.13.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28185",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-23T18:57:08.693509Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T17:50:37.115Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:48:49.601Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf"
},
{
"name": "https://github.com/judge0/judge0/commit/846d5839026161bb299b7a35fd3b2afb107992fc",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/commit/846d5839026161bb299b7a35fd3b2afb107992fc"
},
{
"name": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L197-L201",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L197-L201"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.13.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a `run_script` to the sandbox directory. The security issue is that an attacker can create a symbolic link (symlink) at the path `run_script` before this code is executed, resulting in the `f.write` writing to an arbitrary file on the unsandboxed system. An attacker can leverage this vulnerability to overwrite scripts on the system and gain code execution outside of the sandbox.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-18T14:39:38.915Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf"
},
{
"name": "https://github.com/judge0/judge0/commit/846d5839026161bb299b7a35fd3b2afb107992fc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/commit/846d5839026161bb299b7a35fd3b2afb107992fc"
},
{
"name": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L197-L201",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L197-L201"
}
],
"source": {
"advisory": "GHSA-h9g2-45c8-89cf",
"discovery": "UNKNOWN"
},
"title": "Judge0 vulnerable to Sandbox Escape via Symbolic Link"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-28185",
"datePublished": "2024-04-18T14:31:16.326Z",
"dateReserved": "2024-03-06T17:35:00.857Z",
"dateUpdated": "2024-08-02T00:48:49.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29021 (GCVE-0-2024-29021)
Vulnerability from nvd – Published: 2024-04-18 14:43 – Updated: 2024-08-02 01:03
VLAI
Title
SSRF into Sandbox Escape through Unsafe Default Configuration
Summary
Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/judge0/judge0/security/advisor… | x_refsource_CONFIRM |
| https://github.com/judge0/judge0/blob/ad66f77b131… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:judge0:judge0:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29021",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-20T03:28:23.555484Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:57:28.371Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:03:51.554Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-q7vg-26pg-v5hr",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-q7vg-26pg-v5hr"
},
{
"name": "https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L203-L230",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L203-L230"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.13.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1393",
"description": "CWE-1393: Use of Default Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-18T14:43:33.770Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-q7vg-26pg-v5hr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-q7vg-26pg-v5hr"
},
{
"name": "https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L203-L230",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L203-L230"
}
],
"source": {
"advisory": "GHSA-q7vg-26pg-v5hr",
"discovery": "UNKNOWN"
},
"title": "SSRF into Sandbox Escape through Unsafe Default Configuration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-29021",
"datePublished": "2024-04-18T14:43:33.770Z",
"dateReserved": "2024-03-14T16:59:47.611Z",
"dateUpdated": "2024-08-02T01:03:51.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28189 (GCVE-0-2024-28189)
Vulnerability from nvd – Published: 2024-04-18 14:40 – Updated: 2024-08-02 00:48
VLAI
Title
Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Link
Summary
Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it's own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/judge0/judge0/security/advisor… | x_refsource_CONFIRM |
| https://github.com/judge0/judge0/security/advisor… | x_refsource_MISC |
| https://github.com/judge0/judge0/commit/f3b8547b3… | x_refsource_MISC |
| https://github.com/judge0/judge0/blob/v1.13.0/app… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:judge0:judge0:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"lessThanOrEqual": "1.13.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28189",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-07T19:38:56.803559Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-07T19:40:09.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:48:49.514Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg"
},
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf"
},
{
"name": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd"
},
{
"name": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.13.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it\u0027s own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-18T14:40:29.320Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg"
},
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf"
},
{
"name": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd"
},
{
"name": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232"
}
],
"source": {
"advisory": "GHSA-3xpw-36v7-2cmg",
"discovery": "UNKNOWN"
},
"title": "Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Link"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-28189",
"datePublished": "2024-04-18T14:40:29.320Z",
"dateReserved": "2024-03-06T17:35:00.859Z",
"dateUpdated": "2024-08-02T00:48:49.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28185 (GCVE-0-2024-28185)
Vulnerability from nvd – Published: 2024-04-18 14:31 – Updated: 2024-08-02 00:48
VLAI
Title
Judge0 vulnerable to Sandbox Escape via Symbolic Link
Summary
Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a `run_script` to the sandbox directory. The security issue is that an attacker can create a symbolic link (symlink) at the path `run_script` before this code is executed, resulting in the `f.write` writing to an arbitrary file on the unsandboxed system. An attacker can leverage this vulnerability to overwrite scripts on the system and gain code execution outside of the sandbox.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/judge0/judge0/security/advisor… | x_refsource_CONFIRM |
| https://github.com/judge0/judge0/commit/846d58390… | x_refsource_MISC |
| https://github.com/judge0/judge0/blob/v1.13.0/app… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:judge0:judge0:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"lessThanOrEqual": "1.13.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28185",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-23T18:57:08.693509Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T17:50:37.115Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:48:49.601Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf"
},
{
"name": "https://github.com/judge0/judge0/commit/846d5839026161bb299b7a35fd3b2afb107992fc",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/commit/846d5839026161bb299b7a35fd3b2afb107992fc"
},
{
"name": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L197-L201",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L197-L201"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "judge0",
"vendor": "judge0",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.13.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a `run_script` to the sandbox directory. The security issue is that an attacker can create a symbolic link (symlink) at the path `run_script` before this code is executed, resulting in the `f.write` writing to an arbitrary file on the unsandboxed system. An attacker can leverage this vulnerability to overwrite scripts on the system and gain code execution outside of the sandbox.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-18T14:39:38.915Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf"
},
{
"name": "https://github.com/judge0/judge0/commit/846d5839026161bb299b7a35fd3b2afb107992fc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/commit/846d5839026161bb299b7a35fd3b2afb107992fc"
},
{
"name": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L197-L201",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L197-L201"
}
],
"source": {
"advisory": "GHSA-h9g2-45c8-89cf",
"discovery": "UNKNOWN"
},
"title": "Judge0 vulnerable to Sandbox Escape via Symbolic Link"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-28185",
"datePublished": "2024-04-18T14:31:16.326Z",
"dateReserved": "2024-03-06T17:35:00.857Z",
"dateUpdated": "2024-08-02T00:48:49.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}