CVE-2024-23682

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23682
Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/advisories/GHSA-227w-wv4j-67h4 Exploit Third Party Advisory
https://github.com/ls1intum/Ares/issues/15 Issue Tracking
https://github.com/ls1intum/Ares/releases/tag/1.8.0 Release Notes
https://github.com/ls1intum/Ares/security/advisories/GHSA-227w-wv4j-67h4 Exploit Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-227w-wv4j-67h4 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ls1intum:artemis_java_test_sandbox:*:*:*:*:*:*:*:*
History

26 Jan 2024, 15:08

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:ls1intum:artemis_java_test_sandbox:*:*:*:*:*:*:*:*
First Time Ls1intum artemis Java Test Sandbox
Ls1intum
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.2
References () https://github.com/advisories/GHSA-227w-wv4j-67h4 - () https://github.com/advisories/GHSA-227w-wv4j-67h4 - Exploit, Third Party Advisory
References () https://github.com/ls1intum/Ares/issues/15 - () https://github.com/ls1intum/Ares/issues/15 - Issue Tracking
References () https://github.com/ls1intum/Ares/releases/tag/1.8.0 - () https://github.com/ls1intum/Ares/releases/tag/1.8.0 - Release Notes
References () https://github.com/ls1intum/Ares/security/advisories/GHSA-227w-wv4j-67h4 - () https://github.com/ls1intum/Ares/security/advisories/GHSA-227w-wv4j-67h4 - Exploit, Vendor Advisory
References () https://vulncheck.com/advisories/vc-advisory-GHSA-227w-wv4j-67h4 - () https://vulncheck.com/advisories/vc-advisory-GHSA-227w-wv4j-67h4 - Third Party Advisory
Summary
  • (es) Las versiones de Artemis Java Test Sandbox anteriores a 1.8.0 son vulnerables a un escape de la sandbox cuando un atacante incluye archivos de clase en un paquete en el que Ares confía. Un atacante puede abusar de este problema para ejecutar Java arbitrario cuando una víctima ejecuta el código supuestamente aislado.

19 Jan 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-19 21:15

Updated : 2024-01-26 15:08

NVD link : CVE-2024-23682

Mitre link : CVE-2024-23682

CVE.ORG link : CVE-2024-23682

JSON object : View

Products Affected

ls1intum

  • artemis_java_test_sandbox
CWE
NVD-CWE-noinfo CWE-501

Trust Boundary Violation

CWE-653

Insufficient Compartmentalization