CVE-2024-29021 CRITICAL

CVE-2024-29021: SSRF into Sandbox Escape through Unsafe Default Configuration

Vendor Judge0
Product judge0
Weakness CWE-918 · SSRF
Published April 18, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.

Key dates

02Disclosure timeline

April 18, 2024 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-1379 URL Restriction Bypass in plantuml/plantuml CVE-2025-0480 wuzhicms config.php test server-side request forgery CVE-2024-37260 WordPress Foxiz Theme theme <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability CVE-2022-45835 WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF) CVE-2025-14516 Yalantis uCrop URL com.yalantis.ucrop.task.BitmapLoadTask.java downloadFile server-side request forgery