Quick answers
- Is CVE-2024-36858 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-36858 being exploited in the wild.
- How severe is CVE-2024-36858?
- Low severity, with a CVSS score of 3.1, published 4 June 2024.
- Which products and versions are affected?
- Jan 0.4.12 and earlier; @janhq/core (npm) SEMVER:introduced=0,last_affected=0.1.11.
- Is there a fix for CVE-2024-36858?
- A patch was published on 2024-07-11: Fixed in Jan v0.5.2 via path validation improvements Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-36858 attacked?
- It is attacked over the network.
- Am I affected by CVE-2024-36858?
- Check whether you run Jan or @janhq/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An unrestricted file upload vulnerability exists in the /v1/app/writeFileSync interface of Jan v0.4.12 and earlier, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability stems from insufficient path validation in file write operations. Attackers can exploit this via network requests without authentication to upload arbitrary files to sensitive locations on the system, enabling arbitrary code execution. The vulnerability has been patched in janhq/jan v0.5.2; the deprecated @janhq/core library should no longer be used.
Affected products
- Jan Jan 0.4.12 and earlier
- Jan core 0.1.11 and earlier (deprecated)
Identifiers
- CVE-2024-36858
- GHSA-qfjh-mvq6-c5p8
Timeline
- 2024-06-04: disclosed
- 2024-07-11: patched: Fixed in Jan v0.5.2 via path validation improvements