by Kastro
Paper/Archive/CVE-2024-29021

CVE-2024-29021

judge0 judge0 — SSRF into Sandbox Escape through Unsafe Default Configuration

EPSS 20%CVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 97.5.975 × 2019.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.

Affected

ProductAffectedFixed inSource
judge0<= 1.13.0–CNA
judge0-–CISA-ADP

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/judge0/judge0/security/advisories/GHSA-q7vg-26pg-v5hrrefgithub.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L203-L230