^{CVE-2024-10919:}A remote OS command injection vulnerability exists in didi Super-Jacoco 1.0 via the /cov/triggerUnitCover endpoint by manipulating the uuid parameter, potentially allowing an attacker to execute arbitrary commands on the host. The advisory notes this vulnerability as critical, and it affects the 1.0 release.

Overview

This CVE describes a command injection vulnerability in didi Super-Jacoco 1.0 arising from unsafe handling of the uuid parameter in the /cov/triggerUnitCover endpoint. The flaw permits remote exploitation, enabling an attacker to run arbitrary commands on the host, with potential impact depending on the privileges of the running process. The vulnerability is associated with OS command injection (CWE-78) and general injection (CWE-74), and public disclosures of the exploit indicate real-world risk.

Remediation

• Upgrade to a fixed version or apply vendor-provided patch for didi Super-Jacoco if a fix is released for the 1.0 line. If no patch is available, implement compensating controls and monitor for exploitation.
• Validate and sanitize all user-controlled inputs, especially the uuid parameter, on the server side. Avoid constructing shell commands from input; use safe APIs or parameterized calls.
• Implement strict input validation and allow-listing for expected uuid formats; reject unexpected patterns before they reach any command execution layer.
• Restrict access to the vulnerable endpoint (/cov/triggerUnitCover) with authentication, authorization checks, and network access controls (e.g., IP allowlists, firewall rules).
• Run the application with least-privilege privileges and separate the service account from highly sensitive system credentials.
• Deploy Web Application Firewall (WAF) rules or IDS signatures to detect and block command-injection payloads targeting this endpoint.
• Conduct testing in a controlled environment to verify that input validation and command execution paths are properly hardened before deploying to production.
• Monitor logs and implement alerting for suspicious payloads or anomalous command executions; if exploitation is detected, rotate credentials, investigate, and contain affected hosts.

References

• VDB-283315 | didi Super-Jacoco triggerUnitCover os command injection — https://vuldb.com/?id.283315
• VDB-283315 | CTI Indicators (IOB, IOC, TTP, IOA) — https://vuldb.com/?ctiid.283315
• Submit #432689 | didi super-jacoco 1.0 Command Injection — https://vuldb.com/?submit.432689
• GitHub issue: didi/super-jacoco/issues/49 — https://github.com/didi/super-jacoco/issues/49