CVE-2024-52585 Autolab has HTML Injection Vulnerability
An HTML injection vulnerability in Autolab allows attackers to inject malicious scripts into the grade submissions page, potentially compromising instructor and CA accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-52585?
CVE-2024-52585 is a low-severity cross-site scripting vulnerability in Autolab, published on 18 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing line 589 on `gradesheet.js.erb` to take in feedback as text rather than html.
Weakness: CWE-79
Which versions are affected by CVE-2024-52585?
It affects 1 product.
Products include Autolabproject Autolab.
How do I fix CVE-2024-52585?
No fix has been published for CVE-2024-52585 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-52585 being exploited?
There is no known exploitation of CVE-2024-52585 in the wild and no public exploit code.
Other vulnerabilities in Autolab
- CVE-2022-41955 Autolab is vulnerable to remote code execution (RCE) via MOSS functionality
- CVE-2022-0936 Cross-site Scripting (XSS) - Stored in autolab/autolab
- CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab
- CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions
- CVE-2024-53260 Course Roster vulnerable to CSV Injection in Autolab
Sources
Also known as GHSA-8qhp-jhhw-45r2.