Vulnerability · Published Apr 18, 2024 · Assigned by GitHub_M

CVE-2024-29021SSRF into Sandbox Escape through Unsafe Default Configuration

Critical 9.1

In plain English

A critical-severity server-side request forgery in judge0 from judge0. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 20.2% (higher than 97% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)20.2%top 2.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.

Affected products (as reported)

Vendor	Product	Versions
judge0	judge0	<= 1.13.0

Weakness: CWE-918, CWE-1393 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/judge0/judge0/security/advisories/GHSA-q7vg-26pg-v5hr x_refsource_CONFIRM
https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L203-L230 x_refsource_MISC