Overview
Scoold is an open source Q&A and knowledge sharing platform for teams. Its API enforces authentication by URL path, and the authentication filter normalizes paths differently from the request dispatcher. Appending a semicolon to the path (/api;/config) slips past the filter and reaches the config endpoint with no credentials.
An unauthenticated attacker reads the live configuration, including API secrets and database credentials. A PUT request to the same endpoint with Content-Type: application/hocon triggers HOCON file inclusion and reads arbitrary files from the server. Together these give full takeover of the instance. Scoold 1.64.0 fixes the issue. Setting scoold.api_enabled = false is a workaround.
Affected products
- Scoold before 1.64.0 with the API enabled (scoold.api_enabled = true)
Disclosure timeline
- 22 Oct 2024
- CVE-2024-50334 reserved
- 29 Oct 2024
- Erudika releases Scoold 1.64.0 with the fix; GitHub advisory and CVE published the same day
- 16 Jul 2025
- CrowdSec begins tracking exploitation attempts in the wild