### [CVE-2022-41956](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41956)
![](https://img.shields.io/static/v1?label=Product&message=Autolab&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%3D%202.9.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brighgreen)

### Description

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A file disclosure vulnerability was discovered in Autolab's remote handin feature, whereby users are able to hand-in assignments using paths outside their submission directory. Users can then view the submission to view the file's contents. The vulnerability has been patched in version 2.10.0. As a workaround, ensure that the field for the remote handin feature is empty (Edit Assessment > Advanced > Remote handin path), and that you are not running Autolab as `root` (or any user that has write access to `/`). Alternatively, disable the remote handin feature if it is unneeded by replacing the body of `local_submit` in `app/controllers/assessment/handin.rb` with `render(plain: "Feature disabled", status: :bad_request) && return`.

### POC

#### Reference
- https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/

#### Github
No PoCs found on GitHub currently.