Read the docs
TI-2023-15611 Aliases CVE-2023-32317

Autolab tar slip in cheat checker functionality (`GHSL-2023-082`)

Priority LOW 33CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Both "Base File Tar" and "Additional file archive" can be fed with Tar files that contain paths outside their target directories (e.g., `../../../../tmp/tarslipped2.sh`). When the MOSS cheat checker is started the files inside of the archives are expanded to the attacker-chosen locations. This issue may lead to arbitrary file write within the scope of the running process. This issue has been addressed in version 2.11.0. Users are advised to upgrade.

Why it matters now

EPSS 0.00887 59th percentileScored 2026-11-07
Fix Fixed Autolab (autolab): 2.11.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
autolabAutolabbefore 2.11.02.11.0Patch availableCNA
  • Autolab Vendorautolab Affected before 2.11.0 Fixed in 2.11.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:autolabproject:autolab:*:*:*:*:*:*:*:*before 2.11.0Vulnerableautolab
  • cpe:2.3:a:autolabproject:autolab:*:*:*:*:*:*:*:* Versions before 2.11.0 Vulnerable ·autolab

Remediation

  • Fix · CNA Autolab (autolab) Fixed in 2.11.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32317

References

Patch 1

Advisory 1

Other 1

  • TI-2023-15952 Autolab tar slip in Install Assessment functionality (`GHSL-2023-081`) CVSS 3.1HIGH 7.2
  • TI-2022-20296 Autolab is vulnerable to remote code execution (RCE) via MOSS functionality CVSS 3.1HIGH 8.8
  • TI-2022-20297 Autolab is vulnerable to file disclosure via remote handin feature CVSS 3.1MEDIUM 6.5
  • TI-2024-35721 download_all_submissions allows student to download another student's submissions in Autolab CVSS 4.0HIGH 7.1
  • TI-2024-32961 Autolab Has Misconfigured Reset Password Permissions CVSS 4.0HIGH 7.1
  • TI-2024-35723 Course Roster vulnerable to CSV Injection in Autolab CVSS 3.1MEDIUM 6.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences