Skip to content
Fencer Vulns
critical 10.0

CVE-2024-28185 json

Judge0 vulnerable to Sandbox Escape via Symbolic Link

published 2024-04-18 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-25309

cvss
10.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
7.1%
EPSS 7.1% chance of exploitation in 30 days, percentile 94%
public exploits
1
Metasploit

Summary

Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a `run_script` to the sandbox directory. The security issue is that an attacker can create a symbolic link (symlink) at the path `run_script` before this code is executed, resulting in the `f.write` writing to an arbitrary file on the unsandboxed system. An attacker can leverage this vulnerability to overwrite scripts on the system and gain code execution outside of the sandbox.

Patch / fix

Timeline

  1. First public exploit (Metasploit exploit/linux/http/judge0_sandbox_escape_cve_2024_28189)
  2. Published

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

7.06% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

  • judge0 judge0

Classification

Weakness
  • CWE-61 UNIX Symbolic Link (Symlink) Following
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.