Artemis Java Test Sandbox Libary Load Escape

Vulnerability

The Artemis Java Test Sandbox (Ares) before version 1.11.2 fails to override the checkLink method in its custom SecurityManager. This omission allows untrusted code to call System.load or System.loadLibrary without restriction, thereby bypassing the sandbox [1][3]. The missing check means the security manager does not examine attempts to load native libraries, a critical oversight for a sandbox intended to prevent students from executing arbitrary code.

Exploitation

An attacker who can supply untrusted Java code to a victim (e.g., a student submitting code to a test environment) can call System.load("/path/to/malicious.so") or System.loadLibrary("malicious") within the sandbox [2][3]. No additional authentication or network position is required—the victim simply executes the provided code, triggering the library load. The attacker must have already placed a shared library on the file system, but in educational platforms this is often possible through file upload features.

Impact

Successful exploitation grants the attacker arbitrary code execution in the context of the Java test runner, completely escaping the sandbox [4]. This can lead to full compromise of the test environment, including access to hidden tests, modification of results, or lateral movement within the infrastructure.

Mitigation

The vulnerability is patched in version 1.11.2 of Artemis Java Test Sandbox [2][3]. Users should upgrade immediately. No workaround is available for earlier versions. The fix involves adding a checkLink override to the security manager to block unauthorized library loading.