GHSA-98hq-4wmw-98w9: 
Java vulnerability analysis and mitigation

The Artemis Java Test Sandbox (versions before 1.11.2) contains a critical security vulnerability (CVE-2024-23681) that allows for sandbox escape through unauthorized library loading. The vulnerability was discovered and disclosed in February 2023, affecting the Maven package de.tum.in.ase:artemis-java-test-sandbox. This security flaw enables attackers to execute arbitrary Java code by exploiting the System.load or System.loadLibrary functions when victims execute sandboxed code (GitHub Advisory).

The vulnerability stems from a missing checkLink(String) override in the SecurityManager, which fails to prevent the loading of untrusted libraries. The issue has been assigned a CVSS v3.1 base score of 8.2 (High), with a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The vulnerability is classified under CWE-284 (Improper Access Control) and allows attackers to bypass sandbox restrictions through native library loading capabilities (NVD).

The exploitation of this vulnerability can lead to arbitrary code execution within the Java environment. When successfully exploited, it compromises the sandbox's security boundaries, potentially allowing attackers to execute malicious code with elevated privileges. The high severity rating indicates significant potential impact on system confidentiality, integrity, and availability (GitHub Advisory).

The vulnerability has been patched in version 1.11.2 of the Artemis Java Test Sandbox. The fix involves implementing a proper checkLink override in the SecurityManager to prevent unauthorized library loading. The security fix includes adding a checkExec method that throws a SecurityException when attempting to load unauthorized libraries (GitHub Advisory).