CVE-2024-28185 Judge0 vulnerable to Sandbox Escape via Symbolic Link

Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a...

CVE-2024-28185

CVE-2024-28185 affects Judge0’s sandbox escape: the system fails to neutralize symlinks inside the sandbox directory, allowing an attacker to create a symlink at run_script so that f.write targets an arbitrary file on the host outside the sandbox, potentially enabling code execution outside the s...

CVE-2024-28185 Judge0 vulnerable to Sandbox Escape via Symbolic Link

Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a...

Judge0 CE 安全漏洞

Judge0 CE is an open source online code execution system from Judge0 Open Source. A security vulnerability exists in Judge0 CE versions prior to 1.13.1, which originates from an application that does not take into account a symbolic link placed inside a sandboxed directory, and which can be...

PT-2024-22675 · Judge0 · Judge0

Name of the Vulnerable Software and Affected Versions: Judge0 versions prior to 1.13.1 Description: The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery SSRF. This allows an attacker with sufficient access to the Judge0 API to obtai...

Judge0 CE 安全漏洞

Judge0 CE is an open source online code execution system from Judge0 Open Source. A security vulnerability exists in Judge0 CE versions prior to 1.13.1, which originates from an application using UNIX commands on untrusted files inside the sandbox, and can be exploited by an attacker to create...

Judge0 CE 安全漏洞

Judge0 CE is an open source online code execution system from Judge0 Open Source. A security vulnerability exists in Judge0 CE versions prior to 1.13.1. The vulnerability stems from a security issue in the default configuration, which leads to a server-side request forgery that can be exploited b...

Judge0 sandbox escape

Judge0 does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. Module Options msf use exploit/linux/http/judge0/sandboxescapecve202428189 msf...