PT-2023-14048 · Autolab · Autolab

Peter Stöckli · Publicado 2023-01-14 · Atualizado 2023-12-11 · CVE-2022-41956

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Autolab versions prior to 2.10.0

Description A file disclosure issue was found in Autolab's remote handin feature, allowing users to submit assignments using paths outside their submission directory and view the file's contents.

Recommendations For versions prior to 2.10.0, update to version 2.10.0 to resolve the issue. As a temporary workaround, ensure the field for the remote handin feature is empty (Edit Assessment > Advanced > Remote handin path), and do not run Autolab as root (or any user with write access to /). Alternatively, disable the remote handin feature if it is unneeded by replacing the body of local submit in app/controllers/assessment/handin.rb with render(plain: "Feature disabled", status: :bad request) && return.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2022-41956

GHSA-G7X7-MGRV-F24X

Produtos afetados

Autolab

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41956.json · Exploit
• https://github.com/autolab/Autolab/security/advisories/GHSA-g7x7-mgrv-f24x · Nota
• https://securitylab.github.com/advisories/GHSL-2022-100_Autolab · Nota
• https://stackhawk.com/blog/rails-path-traversal-guide-examples-and-prevention · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-41956 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-41956 · Aviso do Fabricante
• https://t.me/cvenotify/63197 · Publicação no Telegram