CVE-2024-24188

The vulnerability consists of a heap-buffer-overflow in the jsiUtils.c module of the Jsish interpreter. An attacker can provide crafted input data that causes a write beyond the allocated heap memory area. This type of error (CWE-787 — out-of-bounds write) can be exploited to overwrite critical data structures in the process memory.

An attacker can cause arbitrary code execution (RCE), take control of the application, or cause it to crash. Due to the network vector without authentication requirements, the attack can be performed remotely without user interaction.

Patches available from the vendor should be applied according to the references. It is recommended to monitor the project repository at https://github.com/pcmacdon/jsish for the patched version. Until the patch is applied, access to Jsish-based services from untrusted networks should be restricted.

Jsish version 3.5.0