CVE-2024-23681
📋 TL;DR
This vulnerability allows attackers to escape the Artemis Java Test Sandbox by loading untrusted native libraries via System.load or System.loadLibrary. This enables arbitrary Java code execution when victims run supposedly sandboxed code. Users of Artemis Java Test Sandbox versions before 1.11.2 are affected.
💻 Affected Systems
- Artemis Java Test Sandbox
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete sandbox escape leading to arbitrary Java code execution with the privileges of the sandbox process, potentially compromising the host system.
Likely Case
Attackers execute arbitrary Java code within the sandbox context, bypassing intended security restrictions and potentially accessing sensitive data.
If Mitigated
Sandboxed code runs with limited privileges, preventing system-level compromise but potentially allowing data exfiltration within sandbox boundaries.
🎯 Exploit Status
Exploitation requires the victim to execute attacker-controlled code within the sandbox, which may require social engineering or other initial access vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.2
Vendor Advisory: https://github.com/ls1intum/Ares/security/advisories/GHSA-98hq-4wmw-98w9
Restart Required: Yes
Instructions:
1. Update Artemis Java Test Sandbox to version 1.11.2 or later. 2. Restart any services using the sandbox. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable native library loading
allConfigure the sandbox to prevent loading of native libraries via System.load or System.loadLibrary
Restrict sandbox permissions
allApply additional security policies to limit what sandboxed code can access
🧯 If You Can't Patch
- Isolate sandboxed code execution to dedicated, restricted environments
- Implement strict input validation and code review for any code executed within the sandbox
🔍 How to Verify
Check if Vulnerable:
Check if Artemis Java Test Sandbox version is below 1.11.2Check Version:
Check build.gradle or pom.xml for Artemis dependency versionVerify Fix Applied:
Verify version is 1.11.2 or higher and test sandbox functionality with controlled test cases📡 Detection & Monitoring
Log Indicators:
- Unexpected native library loading attempts
- Sandbox permission violation logs
- Unusual Java class loading patterns
Network Indicators:
- Outbound connections from sandboxed processes to unexpected destinations
SIEM Query:
Process execution logs showing System.load or System.loadLibrary calls from sandboxed contexts🔗 References
- https://github.com/advisories/GHSA-98hq-4wmw-98w9
- https://github.com/ls1intum/Ares/security/advisories/GHSA-98hq-4wmw-98w9
- https://vulncheck.com/advisories/vc-advisory-GHSA-98hq-4wmw-98w9
- https://github.com/advisories/GHSA-98hq-4wmw-98w9
- https://github.com/ls1intum/Ares/security/advisories/GHSA-98hq-4wmw-98w9
- https://vulncheck.com/advisories/vc-advisory-GHSA-98hq-4wmw-98w9
