Autolab Has Misconfigured Reset Password Permissions

Vulnerability

Autolab version 3.0.0 contains a misconfiguration in its password-reset permissions for email-based accounts [1]. The flaw lies in the UsersController, where the change_password_for_user and update_password_for_user actions lacked proper authorization checks. The skip_before_action :authenticate_for_action was applied without an exception list, allowing insufficiently privileged users to call these endpoints [3]. The fix in commit 301689a narrows the skip to only lti_launch_link_course and adds an explicit action_auth_level :update_password_for_user, :administrator [3].

Exploitation

An attacker with a low-privilege email-based account could invoke the password-change endpoints directly by crafting HTTP requests [4]. No additional authentication bypass is required beyond having a valid account; the controller failed to enforce administrator-level restrictions on these actions [3]. This means any authenticated user could attempt to reset the password of any other user, including instructors or administrators.

Impact

Successful exploitation would allow the attacker to take over a privileged user's account, potentially gaining access to all course management features, including gradebooks, assignment settings, and other students' submissions [2]. The advisory marks this as a high-severity privilege escalation vulnerability [4].

Mitigation

The vulnerability is fixed in Autolab version 3.0.1 [1]. No workarounds are available; upgrading to the patched version is the only remedy [4].