cve-2024-31457
Vulnerability from cvelistv5
Published
2024-04-09 17:39
Modified
2024-08-02 01:52
Severity ?
7.7 (High) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
Summary
gin-vue-admin background arbitrary code coverage vulnerability
References
security-advisories@github.comhttps://github.com/flipped-aurora/gin-vue-admin/commit/b1b7427c6ea6c7a027fa188c6be557f3795e732b
security-advisories@github.comhttps://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-gv3w-m57p-3wc4
security-advisories@github.comhttps://pkg.go.dev/github.com/flipped-aurora/gin-vue-admin/server?tab=versions
Impacted products
flipped-auroragin-vue-admin
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:flipped-aurora:gin-vue-admin:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gin-vue-admin",
            "vendor": "flipped-aurora",
            "versions": [
              {
                "lessThan": "0.0.0-20240409100909-b1b7427c6ea6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-31457",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-26T20:58:45.895171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-03T18:02:21.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:52:57.064Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-gv3w-m57p-3wc4",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-gv3w-m57p-3wc4"
          },
          {
            "name": "https://github.com/flipped-aurora/gin-vue-admin/commit/b1b7427c6ea6c7a027fa188c6be557f3795e732b",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/flipped-aurora/gin-vue-admin/commit/b1b7427c6ea6c7a027fa188c6be557f3795e732b"
          },
          {
            "name": "https://pkg.go.dev/github.com/flipped-aurora/gin-vue-admin/server?tab=versions",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/github.com/flipped-aurora/gin-vue-admin/server?tab=versions"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gin-vue-admin",
          "vendor": "flipped-aurora",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.0.0-20240409100909-b1b7427c6ea6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -\u003e Plugin Template feature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go` function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-09T17:39:52.347Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-gv3w-m57p-3wc4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-gv3w-m57p-3wc4"
        },
        {
          "name": "https://github.com/flipped-aurora/gin-vue-admin/commit/b1b7427c6ea6c7a027fa188c6be557f3795e732b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/flipped-aurora/gin-vue-admin/commit/b1b7427c6ea6c7a027fa188c6be557f3795e732b"
        },
        {
          "name": "https://pkg.go.dev/github.com/flipped-aurora/gin-vue-admin/server?tab=versions",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pkg.go.dev/github.com/flipped-aurora/gin-vue-admin/server?tab=versions"
        }
      ],
      "source": {
        "advisory": "GHSA-gv3w-m57p-3wc4",
        "discovery": "UNKNOWN"
      },
      "title": "gin-vue-admin background arbitrary code coverage vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-31457",
    "datePublished": "2024-04-09T17:39:52.347Z",
    "dateReserved": "2024-04-03T17:55:32.647Z",
    "dateUpdated": "2024-08-02T01:52:57.064Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-31457\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-04-09T18:15:10.263\",\"lastModified\":\"2024-04-10T13:24:00.070\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -\u003e Plugin Template feature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go` function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem.\"},{\"lang\":\"es\",\"value\":\"gin-vue-admin es un sistema de gesti\u00f3n backstage basado en vue y gin, que separa la parte delantera y trasera de la pila completa. La pseudoversi\u00f3n 0.0.0-20240407133540-7bc7c3051067 de gin-vue-admin, correspondiente a la versi\u00f3n 2.6.1, tiene una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en el backend. En la funci\u00f3n Sistema de complementos -\u0026gt; Plantilla de complemento, un atacante puede realizar un directory traversal manipulando el par\u00e1metro `plugName`. Pueden crear carpetas espec\u00edficas como `api`, `config`, `global`, `model`, `router`, `service` y la funci\u00f3n `main.go` dentro de directory traversal especificado. Adem\u00e1s, los archivos Go dentro de estas carpetas pueden tener c\u00f3digo arbitrario insertado en funci\u00f3n de un par\u00e1metro PoC espec\u00edfico. La raz\u00f3n principal de la existencia de esta vulnerabilidad es la controlabilidad del campo PlugName dentro de la estructura. La pseudoversi\u00f3n 0.0.0-20240409100909-b1b7427c6ea6, correspondiente a el commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contiene un parche para el problema. Como workaround, se puede utilizar manualmente un m\u00e9todo de filtrado disponible en el aviso de seguridad de GitHub para rectificar el problema de directory traversal.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.3,\"impactScore\":5.8}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://github.com/flipped-aurora/gin-vue-admin/commit/b1b7427c6ea6c7a027fa188c6be557f3795e732b\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-gv3w-m57p-3wc4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://pkg.go.dev/github.com/flipped-aurora/gin-vue-admin/server?tab=versions\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.