Critical · published April 18, 2024
🚨 An attacker can use a crafty symbolic link to run the chown command on any file outside the sandbox — it's like a sneaky delivery driver misdelivering packages to the wrong address! 🔥 Imagine a delivery service that allows anyone to send packages to any address just by creating a fake label. In the world of Judge0, an attacker can create a symlink that makes the system think they have the right to change ownership on files that belong to someone else, escaping the designated sandbox restrictions. This vulnerability could allow a determined attacker to completely escape the sandbox, gaining the ability to manipulate or even destroy critical files on the host system. This is not just a minor inconvenience — it's a blueprint for chaos, putting sensitive data at risk and potentially allowing unauthorized access to the entire system.
Imagine a delivery service that allows anyone to send packages to any address just by creating a fake label. In the world of Judge0, an attacker can create a symlink that makes the system think they have the right to change ownership on files that belong to someone else, escaping the designated sandbox restrictions. The Judge0 application improperly uses the UNIX chown command on untrusted files by leveraging symbolic links. This flaw can be exploited to gain control over files outside the intended sandbox environment, leading to a complete sandbox escape.
This vulnerability could allow a determined attacker to completely escape the sandbox, gaining the ability to manipulate or even destroy critical files on the host system. This is not just a minor inconvenience — it's a blueprint for chaos, putting sensitive data at risk and potentially allowing unauthorized access to the entire system. Update Judge0 to version 1.13.1 immediately to resolve this issue. Additionally, review any existing symlink handling in your environment to ensure that no untrusted symlinks can be created. Stay vigilant against potential attacks by implementing stricter controls around file permissions. You've got this! By following these steps, you'll reinforce your defenses and keep your system safe! 🛡️