CVE-2024-38504
📋 TL;DR
This vulnerability allows guest users in JetBrains YouTrack to attach files to articles, which should be restricted. It affects YouTrack instances with guest accounts enabled that haven't been updated to the patched version.
💻 Affected Systems
- JetBrains YouTrack
📦 What is this software?
Youtrack by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Guest users could upload malicious files that compromise the server or other users, potentially leading to data exfiltration or system takeover.
Likely Case
Guest users upload inappropriate or spam files to articles, causing content pollution and potential reputational damage.
If Mitigated
With proper access controls and monitoring, impact is limited to minor content management issues.
🎯 Exploit Status
Exploitation requires guest account access but is straightforward once authenticated as guest.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.2.34646
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup YouTrack data. 2. Download YouTrack 2024.2.34646 or later from JetBrains. 3. Stop YouTrack service. 4. Install/upgrade to patched version. 5. Restart YouTrack service.
🔧 Temporary Workarounds
Disable Guest Accounts
allTemporarily disable guest user accounts in YouTrack configuration
Edit YouTrack configuration file to set 'guest.enabled=false'
Restrict File Upload Permissions
allConfigure YouTrack permissions to prevent guest users from attaching files
Use YouTrack admin interface to modify guest user permissions
🧯 If You Can't Patch
- Disable guest user accounts entirely
- Implement strict file upload monitoring and filtering
🔍 How to Verify
Check if Vulnerable:
Check YouTrack version in admin interface or via API. If version is below 2024.2.34646 and guest accounts are enabled, system is vulnerable.Check Version:
curl -s http://youtrack-server/api/admin/version | grep versionVerify Fix Applied:
Verify version is 2024.2.34646 or higher in admin interface. Test guest account cannot attach files to articles.📡 Detection & Monitoring
Log Indicators:
- Guest user file upload attempts in YouTrack audit logs
- Unusual file attachment patterns from guest accounts
Network Indicators:
- HTTP POST requests to attachment endpoints from guest sessions
SIEM Query:
source="youtrack" AND user="guest" AND action="attach_file"