Is CVE-2024-36857 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-36857 being exploited in the wild.

How severe is CVE-2024-36857?

Low severity, with a CVSS score of 3.1, published 4 June 2024.

Which products and versions are affected?

@janhq/core (npm) SEMVER:introduced=0,last_affected=0.1.11.

Is there a fix for CVE-2024-36857?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-36857 attacked?

It is attacked over the network.

Am I affected by CVE-2024-36857?

Check whether you run @janhq/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-36857: Jan path traversal arbitrary file read

CVE-2024-36857 · Severity: low · CVSS 3.1 · Published 2024-06-04

Jan is an open-source alternative to ChatGPT that runs locally on computers. The application contains a critical vulnerability in its file-reading API that allows attackers to read any file on the system without authentication, potentially exposing sensitive data like configuration files, private keys, and user documents stored on the affected computer.

Technologies: @janhq/core (npm). Vendors: npm.

Quick answers

Is CVE-2024-36857 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-36857 being exploited in the wild.
How severe is CVE-2024-36857?: Low severity, with a CVSS score of 3.1, published 4 June 2024.
Which products and versions are affected?: @janhq/core (npm) SEMVER:introduced=0,last_affected=0.1.11.
Is there a fix for CVE-2024-36857?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-36857 attacked?: It is attacked over the network.
Am I affected by CVE-2024-36857?: Check whether you run @janhq/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal / arbitrary file read issue (CWE-22, CWE-31) in Jan's file handling API. The /v1/app/readFileSync endpoint does not sanitize or validate user-supplied file path parameters, allowing attackers to use relative path traversal sequences (e.g., "/../../../etc/passwd") to escape the intended directory and access any file readable by the Jan process. The endpoint is network-accessible via HTTP POST requests without authentication or privilege requirements. An attacker can read sensitive system files, configuration files, or other data accessible to the Jan process. The vulnerability affects versions up to 0.1.11 of the @janhq/core npm package; patched versions should be available through the Jan project's release channels.

Affected products

Jan (janhq) @janhq/core 0.1.11 and earlier, including 0.4.12

Identifiers

CVE-2024-36857
GHSA-5jqc-qj57-4hrc

Timeline

2024-06-04: disclosed: GHSA-5jqc-qj57-4hrc published; CVE-2024-36857 assigned
2024-06-11: other: GitHub security review completed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.