CVE-2024-47180

{
  "id": "CVE-2024-47180",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47180",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-26T19:45:53.317118Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "badges",
          "product": "shields",
          "versions": [
            {
              "status": "affected",
              "version": "< server-2024-09-25"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:badges:shields:*:*:*:*:*:*:*:*"
          ],
          "vendor": "badges",
          "product": "shields",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "server-2024-09-25",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-26T20:15:07.310",
  "references": [
    {
      "url": "https://github.com/badges/shields/commit/ec1b6c8daccda075403c1688ac02603f7aaa50b2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/badges/shields/issues/10553",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/badges/shields/pull/10551",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/badges/shields/security/advisories/GHSA-rxvx-x284-4445",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields using version < `server-2024-09-25` are vulnerable to a remote execution vulnerability via the JSONPath library used by the Dynamic JSON/Toml/Yaml badges. This vulnerability would allow any user with access to make a request to a URL on the instance to the ability to execute code by crafting a malicious JSONPath expression. All users who self-host an instance are vulnerable. This problem was fixed in server-2024-09-25. Those who follow the tagged releases should update to `server-2024-09-25` or later. Those who follow the rolling tag on DockerHub, `docker pull shieldsio/shields:next` to update to the latest version. As a workaround, blocking access to the endpoints `/badge/dynamic/json`, `/badge/dynamic/toml`, and `/badge/dynamic/yaml` (e.g: via a firewall or reverse proxy in front of your instance) would prevent the exploitable endpoints from being accessed."
    },
    {
      "lang": "es",
      "value": "Shields.io es un servicio para insignias concisas, consistentes y legibles en formato SVG y raster. Shields.io y los usuarios que alojan por sí mismos su propia instancia de escudos usando la versión &lt; `server-2024-09-25` son vulnerables a una vulnerabilidad de ejecución remota a través de la librería JSONPath utilizada por las insignias Dynamic JSON/Toml/Yaml. Esta vulnerabilidad permitiría a cualquier usuario con acceso hacer una solicitud a una URL en la instancia con la capacidad de ejecutar código mediante la creación de una expresión JSONPath maliciosa. Todos los usuarios que alojan por sí mismos una instancia son vulnerables. Este problema se solucionó en server-2024-09-25. Aquellos que siguen las versiones etiquetadas deben actualizar a `server-2024-09-25` o posterior. Aquellos que siguen la etiqueta continua en DockerHub, `docker pull shieldsio/shields:next` para actualizar a la última versión. Como workaround, bloquear el acceso a los endpoints `/badge/dynamic/json`, `/badge/dynamic/toml` y `/badge/dynamic/yaml` (por ejemplo: a través de un firewall o proxy inverso frente a su instancia) evitaría que se acceda a los endpoints explotables."
    }
  ],
  "lastModified": "2026-06-17T07:56:41.067",
  "sourceIdentifier": "security-advisories@github.com"
}