CVE-2024-10919
Published: 06 November 2024
Summary
CVE-2024-10919 is a medium-severity Injection (CWE-74) vulnerability in Didi Super-Jacoco. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 8.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability classified as critical has been identified in didi Super-Jacoco version 1.0, specifically affecting an unknown function in the file /cov/triggerUnitCover. The issue stems from improper handling of the uuid argument, which permits OS command injection as indicated by the associated CWEs (CWE-74 and CWE-78). The flaw is remotely exploitable without user interaction and carries a CVSS 4.0 score of 5.3 reflecting limited impacts on confidentiality, integrity, and availability under low-privilege conditions.
An authenticated remote attacker can supply a crafted uuid value to the affected endpoint and execute arbitrary operating system commands on the server. This capability allows the attacker to read, modify, or disrupt limited system resources depending on the runtime context of the Super-Jacoco process, with the public exploit code making the attack straightforward to replicate.
The EPSS score remains flat at 0.0718 with no material increase observed after disclosure. Public references, including a GitHub issue and Vuldb entries, confirm that exploit details have been released but provide no additional information on patches or configuration mitigations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33348
Vulnerability details
A vulnerability has been found in didi Super-Jacoco 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cov/triggerUnitCover. The manipulation of the argument uuid leads to os command injection. The attack can be…
more
launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.
Validates inputs to block special elements that would alter OS command execution.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.