CVE-2024-12798

JaninoEventEvaluator vulnerability

View on CVE.org
Published Dec 19, 2024 CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Description
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core
upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows
attacker to execute arbitrary code by compromising an existing
logback configuration file or by injecting an environment variable
before program execution.





Malicious logback configuration files can allow the attacker to execute
arbitrary code using the JaninoEventEvaluator extension.



A successful attack requires the user to have write access to a
configuration file. Alternatively, the attacker could inject a malicious
environment variable pointing to a malicious configuration file. In both
cases, the attack requires existing privilege.

Remediation

Vendor Solution

Remove Janino from the Java classpath. Alternatively, update to logback version 1.5.13 or later. If you are using the 1.3.x series, update to logback version 1.3.15 or later. Note that the 1.4.x series remains vulnerable.

Vendor Workaround

Remove Janino from the Java classpath. Alternatively, update to logback version 1.5.13 or later. If you are using the 1.3.x series, update to logback version 1.3.15 or later. Note that the 1.4.x series remains vulnerable.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-3605 ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
Github GHSA Github GHSA GHSA-pr98-23f8-jwxv QOS.CH logback-core Expression Language Injection vulnerability
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00161}

 epss

{'score': 0.00131}
Type Values Removed Values Added
Metrics epss

{'score': 0.0015}

 epss

{'score': 0.00161}
Type Values Removed Values Added
First Time appeared Redhat
Redhat apache Camel Spring Boot
CPEs cpe:/a:redhat:apache_camel_spring_boot:4.8.3
Vendors & Products Redhat
Redhat apache Camel Spring Boot
Type Values Removed Values Added
Description ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto and including version 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege. ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
References
Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L'}

threat_severity

Moderate
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto and including version 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
Title JaninoEventEvaluator vulnerability
Weaknesses CWE-917
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/RE:L/U:Clear'}
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
NCSC.ch
Published
Updated
Jan 3, 2025, 1:38 PM
Reserved
Dec 19, 2024, 2:21 PM

View source JSON

Updated
Dec 20, 2024, 8:17 PM

JSON

Status
Deferred
Published
Dec 19, 2024, 4:15 PM
Modified
Jun 17, 2026, 7:00 AM

View source JSON

Severity
Moderate
Public date
Dec 19, 2024, 3:14 PM

View source Bugzilla JSON

No data.