CVE-2024-29021

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-29021

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29021.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-29021

Aliases

GHSA-q7vg-26pg-v5hr

Published

2024-04-18T14:43:33.770Z

Modified

2026-08-12T03:51:09.674245669Z

Severity

9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

SSRF into Sandbox Escape through Unsafe Default Configuration

Details

Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1393",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29021.json"
}

References

Affected packages

Git / github.com/judge0/judge0

Affected ranges

Type

GIT

Repo

https://github.com/judge0/judge0

Events

Introduced

Last affected

ebef0e475cc5bb3599ea7e6d3d73f3600c8f554f

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.13.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.1.2

v1.*

v1.0.0

v1.1.0

v1.1.1

v1.1.2

v1.1.3

v1.1.4

v1.1.5

v1.10.0-extra

v1.11.0-extra

v1.12.0-extra

v1.13.0-extra

v1.2.0

v1.2.1

v1.2.2

v1.3.0

v1.3.1

v1.4.0

v1.5.0

v1.6.0

v1.7.0

v1.7.1

v1.7.1-extra

v1.8.0-extra

v1.9.0-extra

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29021.json"