CVE-2024-12798: JaninoEventEvaluator vulnerability
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto and including version 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension.
A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
Other sources
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension.
A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
— MITRE
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core up to and including version 1.5.12 in Java applications allows attackers to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension.
A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
— GitHub
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12798?
CVE-2024-12798 is considered a high severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2024-12798?
To fix CVE-2024-12798, upgrade to logback-core version 1.3.15 or 1.5.13.
Which versions are affected by CVE-2024-12798?
CVE-2024-12798 affects logback-core versions from 0.1 to 1.3.14 and from 1.4.0 to 1.5.12.
What types of attacks can CVE-2024-12798 facilitate?
CVE-2024-12798 can facilitate attacks that involve executing arbitrary code by compromising the logback configuration.
Are there any other remediation steps for CVE-2024-12798 besides upgrading?
In addition to upgrading, review and secure your logback configuration files to prevent malicious injections.