CVE-2024-50334
📋 TL;DR
This CVE describes a semicolon path injection vulnerability in Scoold's API endpoint that allows unauthenticated attackers to bypass authentication and access sensitive configuration data. Attackers can also perform file reading via HOCON file inclusion to retrieve server configuration files. All Scoold instances with the API enabled and running versions before 1.64.0 are affected.
💻 Affected Systems
- Scoold
📦 What is this software?
Scoold by Erudika
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full access to server configuration files containing secrets, database credentials, API keys, and other sensitive data, leading to complete system compromise.
Likely Case
Unauthenticated attackers retrieve configuration files containing sensitive information that can be used for further attacks against the Scoold instance or related systems.
If Mitigated
With proper controls, attackers can only access limited information or the attack is blocked entirely by network controls.
🎯 Exploit Status
Simple HTTP request manipulation required, no authentication needed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.64.0
Vendor Advisory: https://github.com/Erudika/scoold/security/advisories/GHSA-fhwp-f6g7-rr3p
Restart Required: Yes
Instructions:
1. Backup your Scoold configuration and data. 2. Stop the Scoold service. 3. Update Scoold to version 1.64.0 or later. 4. Restart the Scoold service. 5. Verify the fix by testing the vulnerable endpoints.
🔧 Temporary Workarounds
Disable Scoold API
allDisable the vulnerable API endpoint entirely
Set scoold.api_enabled = false in your Scoold configuration file
🧯 If You Can't Patch
- Implement strict network access controls to limit access to Scoold API endpoints
- Deploy a WAF with rules to block requests containing semicolons in URL paths
🔍 How to Verify
Check if Vulnerable:
Test if you can access /api;/config endpoint without authentication or if PUT requests with Content-Type: application/hocon header succeedCheck Version:
Check Scoold version in web interface or application logs, or run: java -jar scoold.jar --versionVerify Fix Applied:
After patching, verify that /api;/config endpoint returns proper authentication errors or is inaccessible📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /api;/config
- PUT requests with Content-Type: application/hocon header
- Unauthenticated access to configuration endpoints
Network Indicators:
- Unusual traffic patterns to Scoold API endpoints
- Requests with semicolons in URL paths
SIEM Query:
source="scoold.logs" AND (url_path="/api;/config" OR http_method="PUT" AND content_type="application/hocon")