CVE-2023-44395

Executive Summary

CVE-2023-44395 is a path traversal vulnerability in Autolab, a course management service for autograded programming assignments. The flaw allows authenticated instructors to perform arbitrary file reads on the server, potentially exposing sensitive configuration files, source code, or student data. The vulnerability exists in versions prior to 2.12.0 and has been patched in that release. With a CVSS score of 4.9 (Medium), the risk is elevated due to the potential for information disclosure, though exploitation requires instructor-level privileges. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

Autolab is a Ruby on Rails application. The vulnerability is not related to a specific package dependency but rather to insufficient input validation in the assessment file handling logic. The patch in version 2.12.0 addresses the path traversal by sanitizing file paths.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: High (PR:H) – An instructor account is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality: High (C:H) – Arbitrary file read can expose sensitive data.
• Integrity: None (I:N) – No data modification is possible.
• Availability: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for instructor privileges reduces the attack surface, but the potential for significant information disclosure (e.g., database credentials, SSH keys, student submissions) makes this a serious concern for educational institutions.

Deep Dive & Mechanics

The vulnerability resides in Autolab's assessment functionality, which allows instructors to upload and manage assignment files. The application fails to properly sanitize user-supplied file paths when serving assessment-related content. An attacker with instructor privileges can craft a request containing path traversal sequences (e.g., ../) to read arbitrary files outside the intended directory.

Root Cause: The application uses user input to construct file paths without validating that the resulting path remains within the allowed directory. This is a classic path traversal vulnerability (CWE-22).

Attack Scenario:

1. An instructor logs into Autolab.
2. The instructor crafts a request to download an assessment file, but modifies the file path to include ../../../../etc/passwd.
3. The server reads and returns the contents of /etc/passwd, exposing system user information.

Impact: An attacker could read:

• Application configuration files (e.g., database.yml) containing database credentials.
• Source code of the application.
• SSH private keys.
• Other instructors' or students' submissions.
• System files (e.g., /etc/shadow if permissions allow).

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.12.0):

# app/controllers/assessments_controller.rb
def download
  file_path = params[:file_path]
  # No sanitization - directly uses user input
  send_file File.join(Rails.root, 'assessments', file_path)
end

Patched Code (2.12.0):

# app/controllers/assessments_controller.rb
def download
  file_path = params[:file_path]
  # Sanitize: ensure the resolved path is within the allowed directory
  base_dir = File.join(Rails.root, 'assessments')
  resolved_path = File.realpath(File.join(base_dir, file_path))
  if resolved_path.start_with?(base_dir)
    send_file resolved_path
  else
    head :forbidden
  end
end

The patch uses File.realpath to resolve the absolute path and then checks that it starts with the base directory, preventing traversal outside the intended folder.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• An instructor account on a vulnerable Autolab instance (version < 2.12.0).
• Network access to the Autolab web interface.

Exploitation Steps:

1. Log in as an instructor.
2. Identify an endpoint that serves assessment files (e.g., /assessments/:id/download).
3. Craft a request with a path traversal payload:

   GET /assessments/1/download?file_path=../../../../etc/passwd
   

4. The server will return the contents of /etc/passwd.

Example using cURL:

curl -b "session=your_session_cookie" \
  "http://target.autolab.com/assessments/1/download?file_path=../../../../etc/passwd"

Lab Setup:

• Deploy a vulnerable Autolab instance using Docker:

  docker run -d -p 3000:3000 --name autolab-vuln autolab/autolab:2.11.0
  

• Create an instructor account and an assessment.
• Use the above cURL command to test the vulnerability.

Blue Team (Defensive)

Detection:

• Monitor for requests containing ../ or ..%2f in file path parameters.
• Alert on attempts to access files outside the expected assessment directory (e.g., /etc/passwd, /proc/self/environ).
• Use Web Application Firewall (WAF) rules to block path traversal patterns.

Hunting:

• Search web server logs for:
  • file_path parameters containing ../ or ..%2f.
  • HTTP 200 responses to requests for system files.
• Example log entry:

  192.168.1.100 - - [01/Jan/2024:12:00:00 +0000] "GET /assessments/1/download?file_path=../../../../etc/passwd HTTP/1.1" 200 1234
  

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with file_path parameter containing ../ or ..%2f.
  • Outbound connections from the Autolab server to unknown IPs (if exfiltrating data).
• File System IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, /proc/self/environ, or application configuration files.
  • Modified timestamps on sensitive files.
• Log IOCs:
  • Web server logs showing requests for system files.
  • Application logs showing send_file calls with suspicious paths.

Detection Engineering

YARA Rule

rule CVE_2023_44395_Path_Traversal {
  meta:
    description = "Detects path traversal attempts targeting Autolab CVE-2023-44395"
    author = "Valters IT"
    date = "2024-01-01"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-44395"
  strings:
    $traversal1 = "../"
    $traversal2 = "..\\"
    $traversal3 = "%2e%2e%2f"
    $traversal4 = "%2e%2e%5c"
    $sensitive1 = "/etc/passwd"
    $sensitive2 = "/etc/shadow"
    $sensitive3 = "database.yml"
    $sensitive4 = "config/secrets.yml"
  condition:
    any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: Autolab Path Traversal Attempt (CVE-2023-44395)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Autolab assessment download requests
author: Valters IT
date: 2024-01-01
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection:
    cs-uri-query|contains:
      - 'file_path=../'
      - 'file_path=..%2f'
      - 'file_path=%2e%2e%2f'
  condition: selection
falsepositives:
  - Legitimate use of relative paths in assessment files (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-44395 Autolab Path Traversal Attempt"; flow:to_server; content:"GET"; http_method; content:"/assessments/"; http_uri; content:"file_path="; http_uri; pcre:"/file_path=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Autolab to version 2.12.0 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block path traversal patterns.
3. Review access logs for signs of exploitation.

Long-Term Measures:

• Implement input validation for all file path parameters.
• Use a whitelist of allowed files or directories.
• Run Autolab with minimal file system permissions.
• Regularly update dependencies and apply security patches.
• Conduct periodic security audits and penetration testing.

Workarounds:

• No feasible workarounds exist; upgrading is the only reliable fix.

Valters IT