CVE-2024-51499: MarkUs Arbitrary File Write leading up to remote code execution (student accounts)

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-18 · updated 2026-06-17
Weakness: CWE-434

Description

MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability accessible via the update_files method of the SubmissionsController allows authenticated users (e.g. students) to write arbitrary files to any location on the web server MarkUs is running on (depending on the permissions of the underlying filesystem). e.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading.

Affected products

MarkUsProject Markus: before 2.4.8 — fixed in 2.4.8

How to fix

Upgrade to a fixed version: MarkUsProject Markus 2.4.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-51499 or the next vulnerability affects your stack