CVE-2022-41955 Autolab is vulnerable to remote code execution (RCE) via MOSS functionality
Instructors can execute arbitrary code on the server via the MOSS functionality in Autolab, requiring a patch or feature disablement.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-41955?
CVE-2022-41955 is a high-severity command injection vulnerability in Autolab, published on 14 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionality, whereby an instructor with access to the feature might be able to execute code on the server hosting Autolab. This vulnerability has been patched in version 2.10.0. As a workaround, disable the MOSS feature if it is unneeded by replacing the body of `run_moss` in `app/controllers/courses_controller.rb` with `render(plain: "Feature disabled", status: :bad_request) && return`.
Which versions are affected by CVE-2022-41955?
It affects 1 product.
Products include Autolabproject Autolab.
How do I fix CVE-2022-41955?
No fix has been published for CVE-2022-41955 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-41955 being exploited?
There is no known exploitation of CVE-2022-41955 in the wild and no public exploit code.
Other vulnerabilities in Autolab
- CVE-2022-0936 Cross-site Scripting (XSS) - Stored in autolab/autolab
- CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab
- CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions
- CVE-2024-53260 Course Roster vulnerable to CSV Injection in Autolab
- CVE-2023-32317 Autolab tar slip in cheat checker functionality (`GHSL-2023-082`)
Sources
Also known as GHSA-x5r3-vf3p-3269.