CVE-2024-37273: 
JavaScript vulnerability analysis and mitigation

An arbitrary file upload vulnerability was discovered in Jan v0.4.12, specifically affecting the /v1/app/appendFileSync interface. The vulnerability was assigned CVE-2024-37273 and was initially reported on June 4, 2024. This security flaw affects the Jan application, which is an open-source alternative to ChatGPT that runs offline on computers (NVD, MITRE).

The vulnerability stems from insufficient filtering of parameters in Jan's API interface writeFileSync and appendFileSync functions. It has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-94 (Improper Control of Generation of Code) (NVD).

The vulnerability allows attackers to execute arbitrary code by uploading crafted files. Additionally, attackers can exploit this vulnerability to write to system-critical locations, including scheduled tasks and boot items, such as /etc/init.d/, /etc/rc.d/, /etc/rc.local, ~/.bash_profile, ~/.bash_login, and ~/.profile files, potentially leading to system compromise (GitHub POC).

The vulnerability is exploitable through the /v1/app/appendFileSync and writeFileSync interfaces. A proof of concept (POC) has been publicly released demonstrating how attackers can create arbitrary files and append content to existing files on the target system (GitHub POC).