{"id":"CVE-2024-23682","aliases":["GHSA-227w-wv4j-67h4"],"url":"https://o3.security/vulnerability/CVE-2024-23682","summary":"Artemis Java Test Sandbox Class Loading Escape","details":"### Impact\nThis affects all Artemis users who test Java assignments. **Ares is not required.**\nStudents code that gets automatically tested can run arbitrary code in the container,\nor arbitrary code on the machine of an assessor in case of manual correction.\n\n### Patches\nThe problem cannot be resolved easily in Ares itself. Use the Maven Enforcer Plugin as follows:\n\n```xml\n<plugin>\n    <groupId>org.apache.maven.plugins</groupId>\n    <artifactId>maven-enforcer-plugin</artifactId>\n    <version>3.0.0</version>\n    <executions>\n        <execution>\n            <id>enforce-no-student-code-in-trusted-packages</id>\n            <phase>process-classes</phase>\n            <goals>\n                <goal>enforce</goal>\n            </goals>\n        </execution>\n    </executions>\n    <configuration>\n        <rules>\n            <requireFilesDontExist>\n                <files>\n                    <!-- ADD HERE THE RULES ARES TELLS YOU ARE MISSING -->\n                </files>\n            </requireFilesDontExist>\n        </rules>\n    </configuration>\n</plugin>\n```\n\nThis fails the build if student classes reside in such packages that Ares trusts. Trusted packages added in Ares using `@AddTrustedPackage` should be added as well.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a discussion https://github.com/ls1intum/Ares/discussions\n* Open an issue in https://github.com/ls1intum/Ares/issues\n* Email us, see https://github.com/ls1intum/Ares/security/policy\n\n### References\nSee the assignment of Julius that passes the tests in TUM Artemis course: \"Test - Praktikum: Grundlagen der Programmierung (Testkurs für Tutoren) - Security Tests\" (if that still exists in 2022).\n\nAlso see #15 for almost the same problem.","published":"2024-01-19T20:13:55.453Z","modified":"2026-08-12T03:51:41.566178650Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"Maven","name":"de.tum.in.ase:artemis-java-test-sandbox","fixedVersion":"1.8.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/ls1intum/Ares/releases/tag/1.8.0"},{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23682.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-227w-wv4j-67h4"},{"type":"ADVISORY","url":"https://github.com/ls1intum/Ares/security/advisories/GHSA-227w-wv4j-67h4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23682"},{"type":"ADVISORY","url":"https://vulncheck.com/advisories/vc-advisory-GHSA-227w-wv4j-67h4"},{"type":"REPORT","url":"https://github.com/ls1intum/Ares/issues/15"},{"type":"PACKAGE","url":"https://github.com/ls1intum/Ares"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:41.566178650Z"}}