CVE-2024-28189

18.04.2024, 15:15

Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it's own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1.

Link Following

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	10 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub_M	CNA	10 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA-ADP	ADP	---				---
CVE	ADP	---				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 97%

Common Weakness Enumeration

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References

https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232

https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd

https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg

https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf

https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232

https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd

https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg

https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf