Code Injection Vulnerability in Gin-Vue-Admin Backend

CVE-2024-31457

What is CVE-2024-31457?

A vulnerability exists in the backend of the gin-vue-admin management system, specifically within its Plugin System under the Plugin Template feature. This flaw allows an attacker to conduct a directory traversal attack by manipulating the 'plugName' parameter. By exploiting this vulnerability, attackers can create directories and files, such as 'api', 'config', 'global', 'model', 'router', 'service', and 'main.go', with arbitrary code injected into the Go files stored within these folders. The underlying issue stems from insufficient validation of the PlugName field within its structure. A patch has been released in a subsequent pseudoversion, but users are encouraged to manually implement filtering methods outlined in the GitHub Security Advisory as a temporary measure to mitigate this risk.

References