PT-2023-14048 · Autolab · Autolab

Peter Stöckli · Published 2023-01-14 · Updated 2023-12-11 · CVE-2022-41956

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Autolab versions prior to 2.10.0

Description A file disclosure issue was found in Autolab's remote handin feature, allowing users to submit assignments using paths outside their submission directory and view the file's contents.

Recommendations For versions prior to 2.10.0, update to version 2.10.0 to resolve the issue. As a temporary workaround, ensure the field for the remote handin feature is empty (Edit Assessment > Advanced > Remote handin path), and do not run Autolab as root (or any user with write access to /). Alternatively, disable the remote handin feature if it is unneeded by replacing the body of local submit in app/controllers/assessment/handin.rb with render(plain: "Feature disabled", status: :bad request) && return.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-41956

GHSA-G7X7-MGRV-F24X

Affected Products

Autolab

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41956.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-41956 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41956 · Vendor Advisory
• https://github.com/autolab/Autolab/security/advisories/GHSA-g7x7-mgrv-f24x · Note
• https://securitylab.github.com/advisories/GHSL-2022-100_Autolab · Note
• https://stackhawk.com/blog/rails-path-traversal-guide-examples-and-prevention · Note
• https://t.me/cvenotify/63197 · Telegram Post