CVE-2024-31457
Description
gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -> Plugin Template feature, an attacker can perform directory traversal by manipulating the plugName parameter. They can create specific folders such as api, config, global, model, router, service, and main.go function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/flipped-aurora/gin-vue-admin/serverGo | < 0.0.0-20240409100909-b1b7427c6ea6 | 0.0.0-20240409100909-b1b7427c6ea6 |
Patches
1b1b7427c6ea6fixed:修复GHSA-gv3w-m57p-3wc4
1 file changed · +6 −0
server/api/v1/system/sys_auto_code.go+6 −0 modified@@ -5,6 +5,7 @@ import ( "fmt" "net/url" "os" + "path/filepath" "strings" "github.com/flipped-aurora/gin-vue-admin/server/global" @@ -253,6 +254,11 @@ func (autoApi *AutoCodeApi) AutoPlug(c *gin.Context) { response.FailWithMessage(err.Error(), c) return } + if strings.Contains(a.PlugName, string(filepath.Separator)) { + response.FailWithMessage("插件名称不能包含"+string(filepath.Separator), c) + return + } + a.Snake = strings.ToLower(a.PlugName) a.NeedModel = a.HasRequest || a.HasResponse err = autoCodeService.CreatePlug(a)
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- github.com/advisories/GHSA-gv3w-m57p-3wc4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-31457ghsaADVISORY
- github.com/flipped-aurora/gin-vue-admin/blob/746af378990ebf3367f8bb3d4e9684936df152e7/server/api/v1/system/sys_auto_code.go:239ghsaWEB
- github.com/flipped-aurora/gin-vue-admin/commit/b1b7427c6ea6c7a027fa188c6be557f3795e732bnvdWEB
- github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-gv3w-m57p-3wc4nvdWEB
- pkg.go.dev/github.com/flipped-aurora/gin-vue-admin/servernvdWEB
News mentions
0No linked articles in our index yet.