CVE-2024-50334: Erudika Scoold Auth Bypass Vulnerability

CVE-2024-50334 Overview

CVE-2024-50334 is an authentication bypass vulnerability in Erudika Scoold, a Q&A and knowledge sharing platform for teams. The flaw affects the /api;/config endpoint through semicolon path injection. Unauthenticated attackers can append a semicolon in the URL to bypass authentication and access sensitive configuration data. The vulnerability also enables arbitrary file read through Human-Optimized Config Object Notation (HOCON) file inclusion when attackers send PUT requests with the Content-Type: application/hocon header. Erudika fixed the issue in Scoold 1.64.0.

Critical Impact
Unauthenticated remote attackers can bypass authentication on the Scoold API to read server configuration files and disclose sensitive information usable for further exploitation.

Affected Products

Erudika Scoold versions prior to 1.64.0
Deployments exposing the Scoold API endpoint /api
Self-hosted instances with scoold.api_enabled = true

Discovery Timeline

2024-10-29 - CVE-2024-50334 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50334

Vulnerability Analysis

The vulnerability is classified as an authentication bypass using an alternate path or channel [CWE-288]. Scoold's routing logic treats the /api path and /api; path differently for authentication enforcement. Appending a semicolon causes the security filter to skip authentication while the request still reaches the same underlying handler. This class of flaw is common in Java servlet containers where semicolons introduce path parameters that confuse URL matchers.

Once authentication is bypassed, an attacker gains read access to the /config endpoint and can also submit PUT requests. Scoold parses request bodies typed as application/hocon using a HOCON parser that supports file inclusion directives. An attacker leverages this to include arbitrary files from the server's filesystem, returning their contents in the response.

Root Cause

The root cause is inconsistent URL normalization between the authentication filter and the request dispatcher. The filter matches literal paths and fails to strip semicolon-delimited path parameters, while the underlying handler routes /api;/config to the same controller as /api/config. The secondary root cause is unsafe deserialization of HOCON input on an endpoint that lacks proper authentication and does not restrict include directives.

Attack Vector

Exploitation requires only network access to the Scoold API. An attacker issues an HTTP GET request to /api;/config to retrieve configuration values. To read arbitrary files, the attacker issues a PUT request to the same path with the Content-Type: application/hocon header and a body containing a HOCON include directive pointing to a local file. No credentials, tokens, or user interaction are required. See the GitHub Security Advisory GHSA-fhwp-f6g7-rr3p for technical details.

Detection Methods for CVE-2024-50334

Indicators of Compromise

HTTP requests to /api;/config or any Scoold API path containing a semicolon character
PUT requests to /api;/config carrying the Content-Type: application/hocon header
Unexpected outbound reads of files such as /etc/passwd, application configuration files, or credential stores originating from the Scoold process
Access log entries showing successful 2xx responses to /api;/* from unauthenticated sources

Detection Strategies

Inspect web server, reverse proxy, and application access logs for the literal substring ; inside request paths targeting /api
Alert on any PUT request to the Scoold API where the Content-Type header equals application/hocon
Correlate Scoold process file-read telemetry with inbound API requests to surface HOCON include abuse

Monitoring Recommendations

Ingest Scoold application logs and reverse-proxy access logs into a centralized logging platform for path-based query and alerting
Baseline normal Scoold API request patterns and flag deviations such as anomalous content types or unauthenticated configuration reads
Monitor egress from Scoold hosts for unusual data volumes that may indicate configuration or file exfiltration

How to Mitigate CVE-2024-50334

Immediate Actions Required

Upgrade Erudika Scoold to version 1.64.0 or later on all instances
If patching is not immediate, disable the Scoold API by setting scoold.api_enabled = false
Review Scoold access logs for prior exploitation attempts targeting /api;/config
Rotate any credentials, API keys, or secrets stored in the Scoold configuration if exposure is suspected

Patch Information

Erudika released the fix in Scoold 1.64.0. The maintainers published details in the GitHub Security Advisory GHSA-fhwp-f6g7-rr3p. Administrators should validate the running version after upgrade and confirm that the /api;/config endpoint no longer returns configuration data to unauthenticated requests.

Workarounds

Set scoold.api_enabled = false in the Scoold configuration to disable the vulnerable API surface
Add a reverse-proxy rule that rejects any request path containing a semicolon before it reaches Scoold
Block PUT requests with Content-Type: application/hocon at the reverse proxy or web application firewall

bash

# Configuration example: disable the Scoold API as a temporary workaround
scoold.api_enabled = false