CVE-2024-51743

Summary

CVE-2024-51743 is a vulnerability affecting the MarkUs web application for submitting and grading student assignments. In versions prior to 2.4.8, authenticated instructors can exploit arbitrary file write vulnerabilities in the update/upload/create file methods in Controllers, enabling them to write arbitrary files to any location on the server. This could potentially result in delayed remote code execution, particularly when a Ruby file is written to the config/initializers/ subfolder of the Ruby on Rails application. MarkUs has released version 2.4.8 to address this issue, and there are currently no known workarounds other than upgrading at the application level.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.