CVE-2024-51743— MarkUs 代码问题漏洞

Arbitrary File Write leading up to remote code execution (instructor accounts)

MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability in the update/upload/create file methods in Controllers allows authenticated instructors to write arbitrary files to any location on the web server MarkUs is running on (depending on the permissions of the underlying filesystem). e.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading.

N/A

危险类型文件的不加限制上传

MarkUs 代码问题漏洞

MarkUs是MarkUs开源的一个 Ruby on Rails 和 React web 应用程序，用于提交和评分学生作业。 MarkUs v2.4.8之前版本存在代码问题漏洞，该漏洞源于存在任意文件写入漏洞，允许经过身份验证的攻击者将任意文件写入服务器上的任何位置。

N/A

N/A