{"id":"CVE-2024-23681","aliases":["GHSA-98hq-4wmw-98w9"],"url":"https://o3.security/vulnerability/CVE-2024-23681","summary":"Artemis Java Test Sandbox Libary Load Escape","details":"### Summary\nBecause of the missing `checkLink(String)` override in the SecurityManager, students can load libraries and execute arbitrary code.\n\n### Details\nUsing `System.load(String)` or `System.loadLibrary​(String)` students can load and execute arbitrary code.\n\n```java\nprivate static native void start(List<String> args);\n\npublic static void main(String[] args) {\n  System.load(new File(\"path_to_lib.so\").getAbsolutePath());\n  start(List.of(args));\n}\n```\n\nAdding this to the security manager (and a translation) should fix the issue:\n```java\n@Override\npublic void checkExec(String cmd) {\n  try {\n    if (enterPublicInterface())\n      return;\n    throw new SecurityException(localized(\"security.error_link\")); //$NON-NLS-1$\n  } finally {\n    exitPublicInterface();\n  }\n}\n```\n\n### PoC\nSee details.\n\n### Impact\nArbitrary code execution.","published":"2024-01-19T20:51:33.540Z","modified":"2026-08-12T03:51:42.798796243Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"Maven","name":"de.tum.in.ase:artemis-java-test-sandbox","fixedVersion":"1.11.2"}],"fix":null,"references":[{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23681.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-98hq-4wmw-98w9"},{"type":"ADVISORY","url":"https://github.com/ls1intum/Ares/security/advisories/GHSA-98hq-4wmw-98w9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23681"},{"type":"ADVISORY","url":"https://vulncheck.com/advisories/vc-advisory-GHSA-98hq-4wmw-98w9"},{"type":"PACKAGE","url":"https://github.com/ls1intum/Ares"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:42.798796243Z"}}