CVE-2024-23683
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in Artemis Java Test Sandbox versions prior to 1.7.6 allows a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can exploit this issue to execute arbitrary Java code when a victim runs the supposedly sandboxed code.
Risk Assessment
The risk involves complete bypass of sandbox security mechanisms, potentially leading to unauthorized Java code execution in the victim's environment, which could enable data theft or system compromise.
Recommendation
Immediately upgrade Artemis Java Test Sandbox to version 1.7.6 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Artemis Java Test Sandbox
See all- CVE-2024-23682High
A vulnerability in Artemis Java Test Sandbox before version 1.8.0 allows a sandbox escape by including trusted class files. An attacker can exploit this to execute arbitrary Java code when a victim runs the supposedly sandboxed code.
- CVE-2024-23681High
A vulnerability in Artemis Java Test Sandbox before version 1.11.2 allows a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can exploit this to execute arbitrary Java code when a victim runs the supposedly sandboxed code.
Original NVD description (English source)
Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.