CVE-2023-32317 Autolab tar slip in cheat checker functionality (`GHSL-2023-082`)

Medium 6.7 Published 26 May 2023 Updated 2 Aug 2024

Authenticated instructors can achieve arbitrary file write and potential code execution by uploading malicious tar archives to the MOSS cheat checker.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-32317?

CVE-2023-32317 is a medium-severity path traversal vulnerability in Autolab, published on 26 May 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Both "Base File Tar" and "Additional file archive" can be fed with Tar files that contain paths outside their target directories (e.g., `../../../../tmp/tarslipped2.sh`). When the MOSS cheat checker is started the files inside of the archives are expanded to the attacker-chosen locations. This issue may lead to arbitrary file write within the scope of the running process. This issue has been addressed in version 2.11.0. Users are advised to upgrade.

Weakness: CWE-22

Which versions are affected by CVE-2023-32317?

It affects 1 product.

Products include Autolabproject Autolab.

How do I fix CVE-2023-32317?

No fix has been published for CVE-2023-32317 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-32317 being exploited?

There is no known exploitation of CVE-2023-32317 in the wild and no public exploit code.

Sources

Also known as GHSA-h8g5-vhm4-wx6g.