CVE-2024-12798

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12798
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
CVSS

No CVSS.

References
Link Resource
https://logback.qos.ch/news.html#1.3.15
https://logback.qos.ch/news.html#1.5.13
Configurations

No configuration.

History

03 Jan 2025, 14:15

Type Values Removed Values Added
References
  • () https://logback.qos.ch/news.html#1.3.15 -
Summary
  • (es) La vulnerabilidad ACE en JaninoEventEvaluator por parte de QOS.CH logback-core hasta la versión 1.5.12 incluida en aplicaciones Java permite al atacante ejecutar código arbitrario comprometiendo un archivo de configuración de logback existente o inyectando una variable de entorno antes de la ejecución del programa. Los archivos de configuración de logback maliciosos pueden permitir al atacante ejecutar código arbitrario utilizando la extensión JaninoEventEvaluator. Un ataque exitoso requiere que el usuario tenga acceso de escritura a un archivo de configuración. Alternativamente, el atacante podría inyectar una variable de entorno maliciosa que apunte a un archivo de configuración malicioso. En ambos casos, el ataque requiere privilegios existentes.
Summary (en) ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto and including version 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege. (en) ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

19 Dec 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-19 16:15

Updated : 2025-01-03 14:15

NVD link : CVE-2024-12798

Mitre link : CVE-2024-12798

CVE.ORG link : CVE-2024-12798

JSON object : View

Products Affected

No product.

CWE
CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')