CVE-2022-41956 Autolab is vulnerable to file disclosure via remote handin feature
Attackers can read arbitrary files via the remote handin feature in Autolab, exposing sensitive data to unauthorized users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-41956?
CVE-2022-41956 is a medium-severity path traversal vulnerability in Autolab, published on 14 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A file disclosure vulnerability was discovered in Autolab's remote handin feature, whereby users are able to hand-in assignments using paths outside their submission directory. Users can then view the submission to view the file's contents. The vulnerability has been patched in version 2.10.0. As a workaround, ensure that the field for the remote handin feature is empty (Edit Assessment > Advanced > Remote handin path), and that you are not running Autolab as `root` (or any user that has write access to `/`). Alternatively, disable the remote handin feature if it is unneeded by replacing the body of `local_submit` in `app/controllers/assessment/handin.rb` with `render(plain: "Feature disabled", status: :bad_request) && return`.
Weakness: CWE-22
Which versions are affected by CVE-2022-41956?
It affects 1 product.
Products include Autolabproject Autolab.
How do I fix CVE-2022-41956?
No fix has been published for CVE-2022-41956 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-41956 being exploited?
There is no known exploitation of CVE-2022-41956 in the wild and no public exploit code.
Other vulnerabilities in Autolab
- CVE-2022-41955 Autolab is vulnerable to remote code execution (RCE) via MOSS functionality
- CVE-2022-0936 Cross-site Scripting (XSS) - Stored in autolab/autolab
- CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab
- CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions
- CVE-2024-53260 Course Roster vulnerable to CSV Injection in Autolab
Sources
Also known as GHSA-g7x7-mgrv-f24x.