CVE-2024-47180
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
Summary
Shields.io and self-hosted instances of shields using version < `server-2024-09-25` are vulnerable to a remote execution vulnerability via the JSONPath library used by the Dynamic JSON/Toml/Yaml badges. This vulnerability allows any user with access to make a request to a URL on the instance to execute code by crafting a malicious JSONPath expression.
Impact
This vulnerability could allow attackers to execute arbitrary code on affected systems. Given the high impact on confidentiality, integrity, and availability, it could lead to unauthorized access, data manipulation, or service disruption. The attack vector is network-based, requires low attack complexity, and only low privileges, making it relatively easy to exploit.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been fixed in version `server-2024-09-25`. Users who follow tagged releases should update to `server-2024-09-25` or later. Those who follow the rolling tag on DockerHub can run `docker pull shieldsio/shields:next` to update to the latest version.
Mitigation
1. Update to version `server-2024-09-25` or later. 2. For those unable to update immediately, a workaround is available: block access to the endpoints `/badge/dynamic/json`, `/badge/dynamic/toml`, and `/badge/dynamic/yaml` using a firewall or reverse proxy in front of your instance. 3. Regularly monitor for and apply security updates. 4. Implement network segmentation and access controls to limit potential exposure.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
NVD published the first details for CVE-2024-47180
A CVSS base score of 8.8 has been assigned.
Feedly found the first article mentioning CVE-2024-47180. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.05% (Percentile: 16.3%)