Skip to content

fix: CVE-2024-38821 #41221

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
subrata71 merged 1 commit into from
Sep 15, 2025
Merged

fix: CVE-2024-38821 #41221

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,8 @@ RUN <<END
exit 1
fi

if ! [ -f server/mongo/server.jar -a -f server/pg/server.jar ]; then
echo "Missing one or both server.jar files in the right place. Are you using the build script?" >&2
if ! [ -f server/mongo/server.jar ]; then
echo "Missing MongoDB server.jar file. Are you using the build script?" >&2
exit 1
fi
END
Expand Down
16 changes: 7 additions & 9 deletions scripts/prepare_server_artifacts.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,20 +9,18 @@ if [[ -z "${EDITION-}" ]]; then
fi
fi

PG_TAG="${PG_TAG-pg}"
echo "Will be copying pg server artifacts from appsmith-$EDITION:$PG_TAG"
echo "Building server artifacts for $EDITION edition (PostgreSQL support removed)"

target="deploy/docker/fs/opt/appsmith/server"
mkdir -p "$target"
rm -rf "$target"/{pg,mongo}

# Build MongoDB server artifacts
cp -r "app/server/dist" "$target/mongo"
mv "$target/mongo"/server-*.jar "$target/mongo/server.jar"

Comment on lines +18 to 21

@coderabbitai coderabbitai Bot Sep 12, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Guard against 0 or >1 server-*.jar matches.

mv "$target/mongo"/server-*.jar ... is brittle if the glob matches none or multiple files.

Apply:

 cp -r "app/server/dist" "$target/mongo"
-mv "$target/mongo"/server-*.jar "$target/mongo/server.jar"
+shopt -s nullglob
+jars=( "$target/mongo"/server-*.jar )
+if (( ${#jars[@]} == 1 )); then
+  mv "${jars[0]}" "$target/mongo/server.jar"
+else
+  echo "Expected exactly one server-*.jar in $target/mongo, found ${#jars[@]}: ${jars[*]}" >&2
+  exit 1
+fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Build MongoDB server artifacts
cp -r "app/server/dist" "$target/mongo"
mv "$target/mongo"/server-*.jar "$target/mongo/server.jar"
# Build MongoDB server artifacts
cp -r "app/server/dist" "$target/mongo"
shopt -s nullglob
jars=( "$target/mongo"/server-*.jar )
if (( ${#jars[@]} == 1 )); then
mv "${jars[0]}" "$target/mongo/server.jar"
else
echo "Expected exactly one server-*.jar in $target/mongo, found ${#jars[@]}: ${jars[*]}" >&2
exit 1
fi
🤖 Prompt for AI Agents 
In scripts/prepare_server_artifacts.sh around lines 18–21, the mv using the glob
"server-*.jar" can fail or pick the wrong file when the glob expands to zero or
multiple matches; change the logic to enable safe globbing (e.g. set nullglob),
collect matches into an array, verify the array length is exactly 1 and exit
with a clear error if it is 0 or >1, then mv that single element to
"$target/mongo/server.jar". Ensure the script uses an explicit check and error
message instead of relying on mv's behavior.

# Grab PostgreSQL server artifacts from Docker image.
image="appsmith/appsmith-$EDITION:$PG_TAG"
docker run --name xx --detach --entrypoint sleep "$image" infinity
docker cp xx:/opt/appsmith/server/pg "$target/pg"
docker cp xx:/opt/appsmith/info.json "$target/pg/source-info.json"
docker rm --force xx
docker image rm "$image"
# PostgreSQL support has been removed - no more vulnerable artifacts
# This eliminates CVE-2024-38821 from the Docker image
echo "✅ MongoDB artifacts prepared successfully"
echo "🗑️ PostgreSQL artifacts skipped (CVE-2024-38821 eliminated)"
echo "📁 Only MongoDB artifacts: $target/mongo/"
Comment on lines +22 to +26

@coderabbitai coderabbitai Bot Sep 12, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Good call removing PG artifacts for CVE mitigation; verify no lingering PG references.

Looks aligned with the Dockerfile change. Let’s ensure no PG paths/tags remain elsewhere.

🏁 Script executed:

#!/bin/bash
set -euo pipefail
# Find lingering references to PG artifacts/tags/paths
rg -nC2 -g '!**/node_modules/**' -P '(?i)\b(server/pg|pg/server\.jar|PG_TAG|postgresql)\b'

Length of output: 148

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "Searching repo for PostgreSQL references..."
# Search broadly (include ignored/hidden files) for common postgres/postgresql references and known artifact names.
rg -nC2 --hidden --no-ignore -i -e "postgres" -e "postgresql" -e "PG_TAG" -e "server/pg" -e "pg/server\.jar" -e "FROM postgres" -e "postgres:" || true

Length of output: 263951

Action required — Postgres artifacts remain; CVE mitigation incomplete

prepare_server_artifacts.sh removal is fine, but the image and startup still reference/install Postgres — the vulnerable artifacts will remain unless these are removed or disabled.

  • Key locations to fix:
    • deploy/docker/base.dockerfile (installs postgresql-14; PATH /usr/lib/postgresql/14/bin)
    • deploy/docker/fs/opt/appsmith/{run-postgres.sh, pg-upgrade.sh, pg-utils.sh, entrypoint.sh — init_postgres/safe_init_postgres/create_appsmith_pg_db, supervisord/postgres.conf, postgres/appsmith_hba.conf}
    • deploy/docker/fs/opt/appsmith/templates/docker.env.sh (APPSMITH_POSTGRES_DB_URL)
    • deploy/helm/* (values.yaml, templates/deployment.yaml, templates/configMap.yaml — postgresql.enabled / init container)
    • deploy/docker/tests/* (test-pg-utils.sh, pg-test-utils.sh, pg-upgrade tests)
    • scripts/trivy_vulnerabilities_data.sh (psql usage)

Action: remove Postgres package/install and embedded startup files from the Docker image (or fully disable embedded Postgres and ensure no postgres packages are installed), then re-run vulnerability scan and grep to confirm no remaining runtime artifacts.

🤖 Prompt for AI Agents 
In scripts/prepare_server_artifacts.sh around lines 22 to 26, the comment claims
PostgreSQL artifacts were skipped but the repository still installs and
references Postgres in multiple places; remove or disable those runtime
artifacts to fully mitigate CVE-2024-38821. Remove postgresql-14 installation
and any PATH additions from deploy/docker/base.dockerfile; delete or disable
run-postgres.sh, pg-upgrade.sh, pg-utils.sh, entrypoint
init_postgres/safe_init_postgres/create_appsmith_pg_db logic,
supervisord/postgres.conf and postgres/appsmith_hba.conf under
deploy/docker/fs/opt/appsmith (or ensure they are not copied into image); remove
APPSMITH_POSTGRES_DB_URL and related templates from
deploy/docker/fs/opt/appsmith/templates/docker.env.sh; update deploy/helm values
and templates to turn off postgresql.enabled and remove init
containers/configMap entries that provision Postgres; update or remove docker
tests that exercise pg utilities under deploy/docker/tests and any scripts using
psql (e.g., scripts/trivy_vulnerabilities_data.sh); after changes rebuild the
image and re-run vulnerability scan and a repo-wide grep for "postgres", "psql",
"postgresql-14" and related init scripts to confirm no Postgres binaries,
configs, or startup hooks remain in the final image.