CVE-2024-29021

CVSS V2 None CVSS V3 None

Description

Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.

Overview

CVE ID
CVE-2024-29021

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-04-18T14:43:33.770Z

Last Modified Date
2024-06-04T17:57:28.371Z

Weakness Enumerations

CWE	URL
CWE-918	http://cwe.mitre.org/data/definitions/918.html
CWE-1393	http://cwe.mitre.org/data/definitions/1393.html

References

Reference URL	Reference Tags
https://github.com/judge0/judge0/security/advisories/GHSA-q7vg-26pg-v5hr	x_refsource_CONFIRM
https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L203-L230	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-29021
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29021

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 02:18:05				Added to TrackCVE