CVE-2024-31457

Summary

CVE-2024-31457 is a code injection vulnerability affecting version 2.6.1 of the gin-vue-admin management system. The issue lies in the Plugin System's Plugin Template feature, where an attacker can manipulate the `plugName` parameter to perform directory traversal. They can create and access specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go`, allowing arbitrary code injection. The root cause is the controllability of the PlugName field within the struct. A patch for the vulnerability is available in commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, and a workaround involves manually filtering directory traversal in the GitHub Security Advisory.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.