The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
CVE-2023-32317: Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2023-32317
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.9%
Summary
CVE-2023-32317 affects the MOSS cheat checker functionality in Autolab, a course management service for auto-graded programming assignments. An authenticated attacker with instructor permissions can upload a crafted Tar file to the "Base File Tar" or "Additional file archive" inputs, with entries containing paths such as `../../../../tmp/tarslipped2.sh` that point outside their target directories. When the MOSS cheat checker runs, the archive contents are extracted to those attacker-chosen locations, allowing arbitrary file write within the scope of the running process.
Mitigation
Fixed in version 2.11.0. Users are advised to upgrade.