CVE-2024-0196 Overview
CVE-2024-0196 is a code injection vulnerability affecting Magic-Api versions up to 2.0.1. The flaw resides in the /resource/file/api/save?auto=1 endpoint, which fails to properly validate user-supplied input. Attackers can manipulate the request parameters to inject and execute arbitrary code on the target server.
The vulnerability requires low-privilege authentication and can be triggered remotely over the network. Public exploit details have been disclosed, increasing the risk of active exploitation against exposed Magic-Api instances. The issue is tracked as VDB-249511 and classified under CWE-94: Improper Control of Generation of Code.
Critical Impact
Authenticated attackers can achieve remote code execution on Magic-Api servers, leading to full compromise of confidentiality, integrity, and availability.
Affected Products
- Magic-Api versions up to and including 2.0.1
- Component identifier: ssssssss:magic-api
- Applications embedding vulnerable Magic-Api releases
Discovery Timeline
- 2024-01-02 - CVE-2024-0196 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0196
Vulnerability Analysis
Magic-Api is a Java-based framework that allows developers to build HTTP APIs through a browser-based interface. The framework exposes management endpoints that accept script content persisted to the server for later execution.
The vulnerable endpoint /resource/file/api/save?auto=1 accepts crafted payloads that are interpreted as executable code by the Magic-Api runtime. Because the auto=1 parameter triggers automatic processing of the saved resource, attackers can achieve immediate code execution without additional user interaction.
Root Cause
The root cause is improper control over code generation [CWE-94]. Magic-Api does not sufficiently sanitize or restrict the content submitted to its file save API before passing it to the script engine. Any authenticated caller with access to the resource management endpoint can supply arbitrary logic that the server subsequently evaluates.
Attack Vector
The attack originates over the network and requires only low-level authenticated access to the Magic-Api management surface. An attacker sends a crafted HTTP request to /resource/file/api/save?auto=1 containing malicious script content. The Magic-Api backend stores and evaluates the payload, executing attacker-controlled code in the context of the running application. Refer to the GitHub Magic-Api Exploit Details for a technical walk-through of the exploitation flow.
Detection Methods for CVE-2024-0196
Indicators of Compromise
- HTTP POST requests to /resource/file/api/save?auto=1 originating from unexpected sources or IP ranges
- Newly created Magic-Api resources containing script constructs such as Runtime.getRuntime().exec or reflective class loading
- Unusual child processes spawned by the Java process hosting Magic-Api
- Outbound network connections from the Magic-Api host to unrecognized destinations
Detection Strategies
- Inspect web server and reverse proxy logs for calls to the save endpoint with the auto=1 query parameter
- Baseline legitimate Magic-Api resource creation activity and alert on deviations in frequency or source
- Deploy web application firewall rules that inspect request bodies for embedded script keywords targeting the framework
Monitoring Recommendations
- Monitor process lineage on hosts running Magic-Api for shell interpreters or scripting binaries spawned by the Java runtime
- Capture and retain full HTTP request bodies for management endpoints to support post-incident forensics
- Correlate authentication events with resource modification actions to identify credential misuse
How to Mitigate CVE-2024-0196
Immediate Actions Required
- Restrict network access to Magic-Api management endpoints so they are unreachable from the public internet
- Rotate credentials for any accounts that can access /resource/file/api/save and enforce strong authentication
- Audit existing Magic-Api resources for unauthorized scripts and remove suspicious entries
Patch Information
No vendor patch is documented in the NVD entry at the time of publication. Consult the VulDB #249511 Report and the upstream Magic-Api project for the latest fix availability, and upgrade beyond version 2.0.1 once a corrected release is published.
Workarounds
- Place Magic-Api behind an authenticated reverse proxy that enforces IP allow-listing for administrative paths
- Disable or block the /resource/file/api/save endpoint at the gateway when the resource editor is not required in production
- Run the Magic-Api process under a least-privilege service account to limit the impact of successful code execution
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
