Artemis Java Test Sandbox Class Loading Escape

Vulnerability

Artemis Java Test Sandbox (Ares) versions before 1.8.0 contain a sandbox escape vulnerability. The issue arises because Ares trusts certain Java packages, and an attacker can include malicious class files in those trusted packages, bypassing the security manager's restrictions [1][2].

Exploitation

An attacker who can supply Java class files (e.g., as part of a student submission) places them in a package that Ares trusts. When a victim—such as a student running tests or an assessor performing manual correction—executes the supposedly sandboxed code, the malicious classes are loaded with elevated privileges, escaping the sandbox [3].

Impact

Successful exploitation allows arbitrary Java code execution within the sandbox context. This can lead to full compromise of the test container or the assessor's machine, depending on the deployment [3].

Mitigation

The vulnerability is patched in Ares version 1.8.0 [4]. For users who cannot upgrade immediately, a workaround using the Maven Enforcer Plugin to detect student classes in trusted packages is described in the security advisory [3].