HM Courts Probate NotificationService.java Injection Vulnerability (CVE-2024-8367)

Key Information 1. Vulnerability Name: - HM COURTS & TRIBUNALS SERVICE PROBATE BACK OFFICE UP TO C1AFE0CDB2B2766D9E24872C4E827F8B82A6CD31 MARKDOWN NOTIFICATIONSERVICE.JAVA INJECTION 2. Vulnerability IDs: - VDB-276270 - CVE-2024-8367 - DTSPB-4180/2614 3. Affected Components: - Markdown Handler - NotificationService.java 4. Affected Version: - c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31 5. Vulnerability Description: - CWE-74: Injection vulnerability due to manipulation with an unknown input. - CWE-74: The product constructs or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. 6. CVSS Meta Temp Score: - 3.4 7. Current Vulnerability Price: - $0-$5k 8. CTI Interest Score: - 3.25 9. Impact: - Integrity 10. Vulnerability Details: - A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown functionality of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component Markdown Handler. The manipulation with an unknown input leads to an injection vulnerability. 11. CVE Summary: - A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown function of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component Markdown Handler. The manipulation leads to injection. Continuous delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as d90230d7cf575e5b0852d56660104c8bd2503c34. It is recommended to apply a patch to fix this issue. 12. Exploit Difficulty: - Easy 13. Technical Details: - Known 14. Vulnerability ID: - CVE-2024-8367 15. Patch: - d90230d7cf575e5b0852d56660104c8bd2503c34 16. Source: - tools.hmcts.net 17. Vulnerability Marketplace: - github.com 18. Vulnerability Description: - The advisory is available at tools.hmcts.net. This vulnerability is traded as CVE-2024-8367. The exploitability is told to be easy. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1055 by the MITRE ATT&CK project. 19. Remediation Recommendation: - Applying the patch d90230d7cf575e5b0852d56660104c8bd2503c34 is able to eliminate this problem. The bugfix is ready for download at github.com. 20. Remarks: - The advisory contains the following remark: --- Summary This vulnerability is an injection flaw affecting the HM Courts & Tribunals Service Probate Back Office, specifically impacting the file within the Markdown Handler component. The CVSS Meta Temp Score is 3.4, with a current vulnerability price ranging from $0 to $5k and a CTI Interest Score of 3.25. Exploitation is considered easy, and technical details are known, although no exploit is currently available. It is recommended to apply the patch to resolve the issue.

Goal Reached Thanks to every supporter — we hit 100%!

HM Courts Probate NotificationService.java Injection Vulnerability (CVE-2024-8367)