CVE-2024-36858: 
JavaScript vulnerability analysis and mitigation

An arbitrary file upload vulnerability was discovered in Jan v0.4.12, specifically in the /v1/app/writeFileSync interface. Jan is an open source alternative to ChatGPT that runs offline on computers with support for multiple engines including llama.cpp and TensorRT-LLM. The vulnerability was disclosed on June 4, 2024 (NVD).

The vulnerability exists in Jan's API interfaces writeFileSync and appendFileSync which fail to properly filter parameters, enabling arbitrary file upload capabilities. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD, GitHub Advisory).

The vulnerability allows attackers to execute arbitrary code by uploading crafted files. Additionally, attackers can exploit this vulnerability to write scheduled tasks and boot items by accessing critical system directories such as /etc/init.d/, /etc/rc.d/, /etc/rc.local, ~/.bash_profile, ~/.bash_login, and ~/.profile files to gain shell access (GitHub Advisory).

The vulnerability is exploitable through the writeFileSync and appendFileSync API endpoints. Proof of concept code demonstrates that attackers can create arbitrary files, write any content, and append to existing files without proper restrictions (GitHub Advisory).