CVE-2024-23681: 
Java vulnerability analysis and mitigation

Artemis Java Test Sandbox versions before 1.11.2 contain a critical security vulnerability (CVE-2024-23681) that allows for sandbox escape through untrusted library loading. The vulnerability was discovered and disclosed in January 2024, affecting the security mechanisms of the Java test environment (NVD, GitHub Advisory).

The vulnerability stems from a missing checkLink(String) override in the SecurityManager, which allows students to load and execute arbitrary code using System.load(String) or System.loadLibrary(String) methods. The issue enables attackers to bypass intended sandbox restrictions and execute native code through library loading. The vulnerability has been assigned a CVSS v3.1 score of 8.3, indicating high severity (GitHub Advisory).

The vulnerability enables arbitrary code execution outside the intended sandbox environment. When exploited, it allows attackers to execute native code with elevated privileges, potentially compromising the security of the entire test environment. This poses significant risks to the confidentiality, integrity, and availability of the system (GitHub Advisory).

The vulnerability has been patched in version 1.11.2 of the Artemis Java Test Sandbox. The fix involves implementing a proper checkLink() override in the SecurityManager to prevent unauthorized library loading. Organizations are strongly advised to upgrade to version 1.11.2 or later to address this security issue (GitHub Advisory).