CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions
Insufficiently privileged users can reset passwords for privileged accounts in Autolab, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49376?
CVE-2024-49376 is a high-severity missing authorization vulnerability in Autolab, published on 25 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. This issue is fixed in version 3.0.1. No known workarounds exist.
Which versions are affected by CVE-2024-49376?
2 open source packages ship an affected version, including Autolab. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Autolab RubyGems | From 3.0.0 | 3.0.1 |
Autolab RubyGems | From 3.0.0 | 3.0.1 |
Products include Autolabproject Autolab.
How do I fix CVE-2024-49376?
Upgrade Autolab to 3.0.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-49376 being exploited?
There is no known exploitation of CVE-2024-49376 in the wild and no public exploit code.
Other vulnerabilities in Autolab
- CVE-2022-41955 Autolab is vulnerable to remote code execution (RCE) via MOSS functionality
- CVE-2022-0936 Cross-site Scripting (XSS) - Stored in autolab/autolab
- CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab
- CVE-2024-53260 Course Roster vulnerable to CSV Injection in Autolab
- CVE-2023-32317 Autolab tar slip in cheat checker functionality (`GHSL-2023-082`)
Sources
Also known as GHSA-v46j-h43h-rwrm.