CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab

High 7.1 Published 25 Nov 2024 Updated 25 Nov 2024

Students can download other students' submissions by exploiting missing authorization checks in the download_all_submissions feature.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-53258?

CVE-2024-53258 is a high-severity missing authorization vulnerability in Autolab, published on 25 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all_submissions feature. This can allow for leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs. This issue has been patched in commit `1aa4c769` which is not yet in a release version, but is expected to be included in version 3.0.3. Users are advised to either manually patch or to wait for version 3.0.3. As a workaround administrators can disable the feature.

Weakness: CWE-862, CWE-359

Which versions are affected by CVE-2024-53258?

It affects 1 product.

Products include Autolabproject Autolab.

How do I fix CVE-2024-53258?

No fix has been published for CVE-2024-53258 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-53258 being exploited?

There is no known exploitation of CVE-2024-53258 in the wild and no public exploit code.

Sources

Also known as GHSA-84qc-7773-2gg3.