CVE-2024-29021 SSRF into Sandbox Escape through Unsafe Default Configuration
An attacker can exploit SSRF in Judge0's default configuration to escape the sandbox and execute code as root on the host.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-29021?
CVE-2024-29021 is a critical server-side request forgery vulnerability in judge0, published on 18 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.
Which versions are affected by CVE-2024-29021?
How do I fix CVE-2024-29021?
No fix has been published for CVE-2024-29021 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-29021 being exploited?
There is no known exploitation of CVE-2024-29021 in the wild and no public exploit code.
Sources
Also known as GHSA-q7vg-26pg-v5hr.