Multiple critical security flaws have been identified in the Judge0 open-source online code execution system, which could potentially be exploited to gain code execution on the target system.

These three flaws, all critical in nature, could allow an adversary with sufficient access to perform a sandbox escape and obtain root permissions on the host machine, according to a report by Australian cybersecurity firm Tanto Security.

Judge0, described by its maintainers as a "robust, scalable, and open-source online code execution system", is used to build applications that require online code execution features. The service is used by 23 customers, including AlgoDaily, CodeChum, and PYnative, among others.

The flaws were discovered and reported by Daniel Cooper in March 2024 and include:

• CVE-2024-28185 - The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox.
• CVE-2024-28189 - A patch bypass for CVE-2024-28185 that stems from the use of the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox.
• CVE-2024-29021 - The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server-Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine.

The problem originates from a Ruby script named "isolate_job.rb," which is responsible for setting up the sandbox, running the code, and storing the results of the execution.

An attacker could exploit these flaws to overwrite scripts on the system and gain code execution outside of the sandbox and on the Docker container running the submission job. Furthermore, the attacker could escalate their privileges outside of the Docker container due to it being run using the privileged flag.

The CVE-2024-29021 flaw is related to a configuration that allows communication with Judge0's PostgreSQL database inside the internal Docker network. This enables the adversary to weaponize the SSRF to connect to the database, change the datatype of relevant columns, and ultimately gain command injection.

Following responsible disclosure, these shortcomings have been addressed in version 1.13.1 released on April 18, 2024. Users of Judge0 are advised to update to the latest version to mitigate potential threats.