CVE-2024-36858
📋 TL;DR
This vulnerability allows attackers to upload arbitrary files to Jan v0.4.12 via the /v1/app/writeFileSync interface, potentially leading to remote code execution. Any system running the vulnerable version of Jan is affected, particularly those exposed to untrusted networks.
💻 Affected Systems
- Jan
📦 What is this software?
Jan by Homebrew
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the server, data exfiltration, and lateral movement within the network.
Likely Case
Remote code execution leading to malware deployment, data theft, or system disruption.
If Mitigated
Limited impact with proper file upload validation and access controls in place.
🎯 Exploit Status
The vulnerability is easily exploitable with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.4.13 or later
Vendor Advisory: https://github.com/janhq/jan
Restart Required: Yes
Instructions:
1. Update Jan to version v0.4.13 or later. 2. Restart the Jan service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable vulnerable endpoint
allBlock or disable the /v1/app/writeFileSync interface
Configure web server/firewall to block requests to /v1/app/writeFileSync
Implement file upload restrictions
allAdd file type validation and size limits to the upload interface
Implement server-side validation for file extensions and MIME types
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jan instances
- Deploy web application firewall with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Check if Jan version is v0.4.12 by examining the application version or configuration files.Check Version:
Check Jan configuration or application logs for version informationVerify Fix Applied:
Verify Jan version is v0.4.13 or later and test the /v1/app/writeFileSync interface with malicious upload attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /v1/app/writeFileSync
- Execution of unexpected files or processes
Network Indicators:
- HTTP POST requests to /v1/app/writeFileSync with suspicious file types
SIEM Query:
source="jan_logs" AND (uri="/v1/app/writeFileSync" AND (file_extension="php" OR file_extension="exe" OR file_extension="sh"))