PT-2023-23952 · Autolab · Autolab

P-

·

Published

2023-05-26

·

Updated

2023-12-11

·

CVE-2023-32676

CVSS v3.1

6.7

Medium

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Name of the Vulnerable Software and Affected Versions Autolab versions prior to 2.11.0
Description A Tar slip vulnerability was found in the Install assessment functionality of Autolab, a course management service for auto-graded programming assignments. To exploit this issue, an authenticated attacker with instructor permissions must upload a specially crafted Tar file. The vulnerability allows an attacker to feed a Tar file containing files with paths pointing outside the target directory, such as ../../../../tmp/tarslipped1.sh. When the Install assessment form is submitted, the files inside the archives are expanded to attacker-chosen locations.
Recommendations For versions prior to 2.11.0, upgrade to version 2.11.0 to address the issue. As a temporary workaround, consider restricting the upload of Tar files or limiting the use of the Install assessment functionality until the upgrade is applied. Restrict access to the Install assessment form to minimize the risk of exploitation. Avoid using the Install assessment functionality with untrusted Tar files until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-32676
GHSA-X9HJ-R9Q4-832C

Affected Products

Autolab