Lucene search

GoogleOSV:GHSA-C4PG-5GGH-VCPP

HistoryJan 19, 2024 - 9:30 p.m.

Sandbox escape in Artemis Java Test Sandbox

2024-01-1921:30:36

Google

osv.dev

artemis java test sandbox

vulnerability

sandbox escape

system.load

system.loadlibrary

arbitrary execution

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

7.6 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.

CPENameOperatorVersion
de.tum.in.ase:artemis-java-test-sandboxeq1.2.1
de.tum.in.ase:artemis-java-test-sandboxeq1.5.1
de.tum.in.ase:artemis-java-test-sandboxeq1.2.2
de.tum.in.ase:artemis-java-test-sandboxeq1.5.3
de.tum.in.ase:artemis-java-test-sandboxeq1.7.3
de.tum.in.ase:artemis-java-test-sandboxeq1.1.1
de.tum.in.ase:artemis-java-test-sandboxeq1.4.0
de.tum.in.ase:artemis-java-test-sandboxeq1.9.1
de.tum.in.ase:artemis-java-test-sandboxeq1.10.0
de.tum.in.ase:artemis-java-test-sandboxeq1.5.4

Name	Operator	Version
de.tum.in.ase:artemis-java-test-sandbox	eq	1.2.1
de.tum.in.ase:artemis-java-test-sandbox	eq	1.5.1
de.tum.in.ase:artemis-java-test-sandbox	eq	1.2.2
de.tum.in.ase:artemis-java-test-sandbox	eq	1.5.3
de.tum.in.ase:artemis-java-test-sandbox	eq	1.7.3
de.tum.in.ase:artemis-java-test-sandbox	eq	1.1.1
de.tum.in.ase:artemis-java-test-sandbox	eq	1.4.0
de.tum.in.ase:artemis-java-test-sandbox	eq	1.9.1
de.tum.in.ase:artemis-java-test-sandbox	eq	1.10.0
de.tum.in.ase:artemis-java-test-sandbox	eq	1.5.4

Rows per page:

1-10 of 411

References

github.com/advisories/GHSA-98hq-4wmw-98w9

github.com/ls1intum/Ares

github.com/ls1intum/Ares/security/advisories/GHSA-98hq-4wmw-98w9

nvd.nist.gov/vuln/detail/CVE-2024-23681

vulncheck.com/advisories/vc-advisory-GHSA-98hq-4wmw-98w9

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

7.6 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for OSV:GHSA-C4PG-5GGH-VCPP