CVE-2024-36858 PoC — Jan 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36858.yaml

Associated Vulnerability

Title:Jan 安全漏洞 (CVE-2024-36858)
Description:Jan是Jan开源的一个 ChatGPT 的开源替代品。 Jan v0.4.12 版本存在安全漏洞，该漏洞源于 /v1/app/writeFileSync 接口中存在任意文件上传漏洞。

Description

An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.

File Snapshot


 id: CVE-2024-36858

info:
  name: Jan v0.4.12 - Arbitrary File Upload
  author: pussycat0x
  severit

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.