PT-2022-28164 · Unknown · Artemis Java Test Sandbox

Maisikoleni

·

Published

2022-01-21

·

Updated

2025-11-28

·

CVE-2024-23683

CVSS v3.1

8.2

High

VectorAV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Artemis Java Test Sandbox versions less than 1.7.6
Description The issue allows an attacker to create special subclasses of InvocationTargetException that escape the exception sanitization. This enables arbitrary student code to be executed in a trusted context, allowing the attacker to disable security measures and gain full control over the system. The attacker can abuse this issue to execute arbitrary Java code when a victim executes the supposedly sandboxed code.
Recommendations Update to version 1.7.6 or later. As a temporary workaround, consider forbidding student classes in trusted packages. Restrict access to trusted packages like de.tum.in.test.api.security.notsealedsubpackage to minimize the risk of exploitation. Avoid using the InvocationTargetException exception in the affected code until the issue is resolved.

Exploit

Fix

Weakness Enumeration

Related Identifiers

CVE-2024-23683
GHSA-23RX-79R7-6CPX
GHSA-883X-6FCH-6WJX

Affected Products

Artemis Java Test Sandbox