Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-23611

CVE-2023-23611:
LTI 1.3 Grade Pass Back Implementation has Missing Authorization Vulnerability

3.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-23611
GHSA ID
GHSA-7j9p-67mm-5g87
EPSS Score
0.36002%
CWE
CWE-862
Published
8/30/2024
Updated
8/30/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
lti-consumer-xblockpip>= 7.0.0, < 7.2.27.2.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the publish_grade_on_score_update signal handler in signals.py. The pre-patch code used the line_item's resource_link_id directly to load and modify grades without verifying if the LTI tool was authorized to write to that XBlock location. The commit diff shows the addition of a critical authorization check (line_item.resource_link_id != lti_config.location) to prevent cross-block grade injection. This function was the entry point for grade persistence logic and lacked proper resource ownership validation prior to the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Pro*l*m TL;*R: *ny LTI tool t**t is int**r*t** wit* on t** Op*n **X pl*t*orm **n post * *r*** ***k *or *ny LTI X*lo*k so lon* *s it knows or **n *u*ss t** *lo*k lo**tion *or t**t X*lo*k. In LTI *.*, LTI tools **n "p*ss ***k" s*or*s t**t l**rn*rs

Reasoning

T** vuln*r**ility st*ms *rom t** pu*lis*_*r***_on_s*or*_up**t* si*n*l **n*l*r in si*n*ls.py. T** pr*-p*t** *o** us** t** lin*_it*m's r*sour**_link_i* *ir**tly to lo** *n* mo*i*y *r***s wit*out v*ri*yin* i* t** LTI tool w*s *ut*oriz** to writ* to t**t