PT-2024-34663 · Markus · Markus

David-Yz-Liu · Published 2024-11-18 · Updated 2025-09-04 · CVE-2024-51499

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.4.8

Description MarkUs is a web application for the submission and grading of student assignments. An arbitrary file write vulnerability accessible via the update files method of the SubmissionsController allows authenticated users to write arbitrary files to any location on the web server, depending on the permissions of the underlying filesystem. This can lead to delayed remote code execution if an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application.

Recommendations For versions prior to 2.4.8, upgrade to MarkUs version 2.4.8 to address this issue. As a temporary workaround, consider restricting access to the SubmissionsController and its update files method to minimize the risk of exploitation.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-51499

GHSA-J95P-7936-F75W

Affected Products

Markus

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51499.json · Exploit
• https://github.com/MarkUsProject/Markus/pull/7026 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-51499 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51499 · Vendor Advisory
• https://github.com/MarkUsProject/Markus/security/advisories/GHSA-j95p-7936-f75w · Note
• https://twitter.com/VulmonFeeds/status/1858644755736912147 · Twitter Post
• https://t.me/cvedetector/11380 · Telegram Post
• https://twitter.com/CVEnew/status/1858605750915854662 · Twitter Post
• https://t.me/cveNotify/134280 · Telegram Post