CVE-2024-24189

Executive Summary

CVE-2024-24189 is a use-after-free vulnerability discovered in Jsish v3.5.0 (commit 42c694c). The flaw resides in the SplitChar function within ./src/jsiUtils.c. A use-after-free occurs when a program continues to use a pointer after the memory it points to has been freed, leading to potential code execution, data corruption, or denial of service. As of this report, no official patch has been released, and the vulnerability remains unpatched. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for systems running the affected version.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the nature of the vulnerability (use-after-free in a C-based interpreter), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – exploitation requires local access to the system.
• Attack Complexity (AC): Low (L) – the vulnerability is straightforward to trigger.
• Privileges Required (PR): None (N) – no special privileges needed.
• User Interaction (UI): Required (R) – the user must execute a crafted script.
• Scope (S): Unchanged (U) – the vulnerability does not cross security boundaries.
• Confidentiality (C): High (H) – potential for memory disclosure.
• Integrity (I): High (H) – potential for memory corruption.
• Availability (A): High (H) – potential for crash or denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Estimated Base Score: 7.8 (High)

Threat Level: High. Although no public exploit exists, the vulnerability is in a core utility function and could be weaponized.

Deep Dive & Mechanics

The vulnerability is a classic use-after-free (UAF) in the SplitChar function of Jsish, a JavaScript interpreter written in C. The function is responsible for splitting strings based on a delimiter character. The flaw occurs when memory allocated for a string or buffer is freed prematurely, but a pointer to that memory is still used later in the function.

Root Cause Analysis:

• In ./src/jsiUtils.c, the SplitChar function likely allocates memory for substrings during the split operation.
• Under certain conditions (e.g., specific input patterns or edge cases), the function may free a buffer while still holding a reference to it.
• Subsequent access to the freed memory leads to undefined behavior, which an attacker can exploit to read or write arbitrary memory.

Attack Scenario:

1. An attacker crafts a malicious JavaScript file that triggers the UAF in SplitChar.
2. The victim executes the script using Jsish v3.5.0.
3. The UAF allows the attacker to corrupt memory, potentially leading to code execution or information disclosure.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (hypothetical based on CWE-416):

// Vulnerable pattern in SplitChar
char *buffer = malloc(size);
// ... some operations ...
free(buffer);
// ... later ...
buffer[0] = 'A'; // Use-after-free

Patched Code (expected fix):

// Patched pattern
char *buffer = malloc(size);
// ... some operations ...
// Ensure no further use after free
free(buffer);
buffer = NULL; // Set to NULL to prevent dangling pointer

The fix would involve either:

• Setting the pointer to NULL after freeing.
• Restructuring the code to avoid freeing memory that is still referenced.
• Using reference counting or garbage collection to manage memory safely.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Jsish v3.5.0 (commit 42c694c) installed on a target system.
• Ability to deliver a malicious .js file to the victim.

Exploitation Steps:

1. Craft the Payload: Create a JavaScript file that triggers the UAF in SplitChar. Example:

   // exploit.js
   var str = "A".repeat(1000);
   var result = str.split("A");
   // Trigger UAF by manipulating the split result
   

2. Deliver the Payload: Use social engineering, phishing, or direct file transfer to get the victim to run the script.
3. Execute: Run jsish exploit.js on the target.
4. Post-Exploitation: If successful, the UAF may allow arbitrary code execution. Use a memory corruption technique (e.g., heap spray) to gain control.

Note: No public exploit code is available. The above is a conceptual approach.

Blue Team (Defense)

Detection:

• Monitor for unusual crashes or segmentation faults in Jsish processes.
• Use memory analysis tools (e.g., Valgrind, AddressSanitizer) to detect UAF during testing.
• Implement application whitelisting to prevent execution of untrusted scripts.

Mitigation:

• Upgrade Jsish to a patched version once available.
• If patching is not possible, restrict execution of Jsish to trusted users only.
• Use sandboxing (e.g., Docker, seccomp) to limit the impact of a potential exploit.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for suspicious .js files)
• Process Names: jsish
• Network Signatures: None specific to this CVE.
• Memory Artifacts: Heap corruption patterns, dangling pointers in jsiUtils.c.
• Log Entries: Segmentation faults, memory access violations in system logs.

Detection Engineering

YARA Rule

rule CVE_2024_24189_Jsish_UAF {
    meta:
        description = "Detects Jsish v3.5.0 binary with use-after-free vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $vuln_func = "SplitChar" ascii wide nocase
        $vuln_version = "3.5.0" ascii wide nocase
    condition:
        $vuln_func and $vuln_version
}

Sigma Rule

title: Jsish Use-After-Free Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-24189 via Jsish crashes
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/jsish'
        CommandLine|contains: '.js'
    condition: selection
falsepositives:
    - Legitimate use of Jsish for scripting
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-24189 Jsish UAF Exploit Attempt"; flow:to_server; content:"jsish"; nocase; content:"split"; nocase; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: If Jsish v3.5.0 is in use, isolate those systems from untrusted networks.
2. Restrict Execution: Limit Jsish execution to trusted users and scripts only.
3. Monitor for Exploitation: Deploy the YARA, Sigma, and Suricata rules above to detect exploitation attempts.

Long-Term Fix:

• Patch: Await an official patch from the Jsish maintainers. Monitor the Jsish GitHub repository for updates.
• Upgrade: Once a patched version is released, upgrade immediately.
• Code Review: Conduct a security audit of jsiUtils.c and other core functions for similar UAF issues.

Workaround:

• If patching is not possible, consider using an alternative JavaScript interpreter (e.g., Node.js, QuickJS) for critical tasks.

Valters IT
DevSecOps & Cyber Threat Intelligence