HotCRP Remote Code Execution Vulnerability in Formulas

A remote code execution vulnerability has been identified in HotCRP conference review software, specifically in versions 3.0.0 prior to 3.1. The issue arises from inadequately sanitized code generation for HotCRP formulas, which allowed users to execute arbitrary PHP code. This vulnerability was introduced in April 2024, after the initial release of version 3.0.0.

Impact

Exploitation of this vulnerability allows for arbitrary PHP code execution on the server where HotCRP is running.

Reproduction

The vulnerability can be reproduced by creating a HotCRP formula that includes unsanitized code. When the formula is processed, the injected PHP code will be executed, demonstrating the remote code execution flaw.

Remediation

Users can upgrade to HotCRP version 3.2 to address this vulnerability.