CVE-2024-50334 Semicolon Path Injection on API /api;/config
Attackers can bypass authentication via semicolon path injection to access sensitive configuration data and read files on Scoold servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-50334?
CVE-2024-50334 is a high-severity authentication bypass vulnerability in Erudika scoold, published on 29 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type: application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false.
Weakness: CWE-288
Which versions are affected by CVE-2024-50334?
It affects 1 product.
Products include Erudika Scoold.
How do I fix CVE-2024-50334?
No fix has been published for CVE-2024-50334 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-50334 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-50334 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Erudika scoold
Sources
Also known as GHSA-fhwp-f6g7-rr3p.