Judge0 Sandbox Vulnerabilities Expose Systems to Takeover Risk
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-28185 | Judge0 is an open-source online code execution system. Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a `run_script` to the sandbox directory. The security issue is that an attacker can create a symbolic link (symlink) at the path `run_script` before this code is executed, resulting in the `f.write` writing to an arbitrary file on the unsandboxed system. An attacker can leverage this vulnerability to overwrite scripts on the system and gain code execution outside of the sandbox. NVD description · AI analysis pending | 10.0 | 7% | — | — | ||
| CVE-2024-28189 | Judge0 is an open-source online code execution system. Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it's own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1. NVD description · AI analysis pending | 10.0 | 7% | — | — | ||
| CVE-2024-29021 | Judge0 is an open-source online code execution system. Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1. NVD description · AI analysis pending | 9.0 | 20% | — | — |
Full article318 words · extracted from infosecurity-magazine.com · click to collapse
Judge0, an open-source service for running arbitrary code within secure sandboxes, has been found to harbor vulnerabilities that could potentially expose systems to complete takeover.
Tanto Security uncovered these vulnerabilities, labeled CVE-2024-29021, CVE-2024-28185 and CVE-2024-28189, which could allow attackers with sufficient access to execute sandbox escapes and gain root permissions on host machines.
According to the security experts, this revelation comes amid growing dependence on Judge0 by organizations focused on development and cybersecurity, including educational institutions and talent recruitment firms.
Such entities rely on Judge0 to execute code securely, particularly in competitive programming environments where the accuracy of code outputs is paramount.
Upon inspecting the Judge0 codebase, Tanto Security identified critical weaknesses. One significant aspect is the utilization of the isolate binary, which leverages Linux namespaces and control groups akin to Docker containers.
However, the container runs in a privileged mode, enabling access to restricted components of the host system, posing a substantial risk if accessed by malicious actors.
The investigation delved into various facets of the Judge0 infrastructure, revealing exploitable points in the code execution process. Notably, vulnerabilities were found in the processing of user-submitted code, allowing for the injection of malicious commands.
These flaws extended to the interaction between Judge0’s components, such as the execution of commands outside the sandbox environment, leading to potential system compromise.
Read more on sandbox security: Infostealer Lumma Evolves With New Anti-Sandbox Method
Despite Judge0’s developer’s initial patching efforts, subsequent bypasses were discovered, highlighting persistent vulnerabilities in the platform.
These findings underscore the ongoing challenges in securing complex software systems, particularly those with intricate interaction points and privileged access to system resources.
The timeline of events illustrates a swift response from both the security researchers and the Judge0 development team in addressing the identified vulnerabilities.
However, the iterative nature of these discoveries emphasizes the need for continuous vigilance and proactive security measures to safeguard against emerging threats in the cybersecurity landscape.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/judge0-sandbox-flaws-systems/