CVE-2024-37902 — AI Deep Analysis Summary

🚨 **Essence**: Path Traversal in Deep Java Library (DJI). 📉 **Consequences**: Attackers can overwrite system files by inserting absolute path archives. 💥 **Impact**: High severity (CVSS 9.8).…

🛡️ **CWE**: CWE-22 (Path Traversal). 🐛 **Flaw**: The library fails to sanitize archive entries. It allows absolute paths, enabling direct insertion into the system filesystem instead of the intended sandbox.

👥 **Vendor**: Deep Java Library (djl). 📦 **Affected**: Versions **0.1.0** up to **0.27.0**. 🚫 **Fixed**: Version 0.28.0 and later are safe.

💻 **Privileges**: Runs with the user's privileges. 📂 **Data**: Can overwrite critical system files. 🧨 **Result**: Remote Code Execution (RCE) potential, service disruption, or data theft via file manipulation.

🔓 **Auth**: None required (PR:N). 🌐 **Network**: Remote (AV:N). 🎯 **UI**: None required (UI:N). 📉 **Complexity**: Low (AC:L). **Verdict**: Extremely easy to exploit remotely.

🕵️ **Public Exp**: No specific PoC code provided in data. 📢 **Status**: Publicly disclosed via GitHub Advisory. ⚠️ **Risk**: High likelihood of wild exploitation due to low barrier to entry.

🔍 **Check**: Scan for `djl` dependency versions < 0.28.0. 📋 **Audit**: Review code for loading archives from untrusted sources. 🛠️ **Tool**: Use SAST/DAST tools detecting CWE-22 in Java archive handling.

✅ **Fixed**: Yes! Upgrade to **v0.28.0**. 🔗 **Source**: [GitHub Release](https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0). 🛡️ **Action**: Immediate patching recommended.

🚧 **Workaround**: If upgrade impossible, **do not** load archives from untrusted sources. 🧹 **Validate**: Manually sanitize archive entry names before extraction.…

🔥 **Priority**: CRITICAL (P1). 🚀 **Urgency**: Immediate action required. 📢 **Reason**: Remote, unauthenticated, low-complexity exploit with severe impact. Patch now!