CVE-2024-28185 — AI Deep Analysis Summary

🚨 **Essence**: Judge0 CE (v1.13.1-) fails to validate **symbolic links** inside its sandbox. 📂 **Consequences**: Attackers bypass isolation, writing arbitrary files & executing code **outside** the sandbox.…

🛡️ **Root Cause**: **CWE-61** (Symbolic Link Following). The app ignores symlink safety checks. 🚫 It trusts paths inside the sandbox without verifying if they point elsewhere. ⚠️ Critical logic flaw in `isolate_job.rb`.

🎯 **Affected**: **Judge0 CE** versions **before 1.13.1**. 📦 Specifically the open-source online code execution system. 🏢 Vendor: **judge0**. Check your version immediately!

💀 **Attacker Power**: Full **Remote Code Execution (RCE)**! 🚀 Can write arbitrary files anywhere on the host. 📝 Can execute malicious code outside the sandbox. 📊 **CVSS**: High (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

🔓 **Threshold**: **LOW**! 📉 **Auth**: None required (PR:N). 🌐 **Network**: Remote (AV:N). 🧠 **Complexity**: Low (AC:L). 🙅 **User Interaction**: None (UI:N). Super easy to exploit!

🕵️ **Public Exp?**: No specific PoC code listed in data. 📄 But **GitHub Advisory** (GHSA-h9g2-45c8-89cf) confirms the flaw. 🔍 Source code links provided. Expect wild exploitation soon given low barrier!

🔍 **Self-Check**: 1. Check Judge0 version < 1.13.1. 📋 2. Scan for exposed Judge0 CE instances. 🌐 3. Review `isolate_job.rb` logic if self-hosted. 🛠️ 4. Look for unexpected file writes outside sandbox.

✅ **Fixed?**: **YES**! 🩹 Patch available in **v1.13.1+**. 📝 Commit `846d583` addresses the symlink issue. 🔗 See GitHub advisory for details. Update NOW!

🚧 **No Patch?**: 1. **Isolate** the service strictly. 🧱 2. Disable symlink creation in sandbox config. 🚫 3. Use strict file system permissions. 🔒 4. Monitor for anomalous file I/O. 📊

🔥 **Urgency**: **CRITICAL**! 🚨 Remote, unauthenticated, low complexity. 📉 High impact (Confidentiality/Integrity/Availability). 🏃‍♂️ Patch immediately to prevent RCE!