Loading vulnerability…
RCE via .htaccess Upload in Chamilo LMS <= 1.11.20
An improper sanitization vulnerability exists in Chamilo LMS (<= v1.11.20) in the file main/inc/lib/fileUpload.lib.php on Windows and Apache installations. The flaw allows attackers to bypass file upload security mechanisms and upload a .htaccess file, which can be used to achieve remote code execution. The vulnerability can be exploited by privileged attackers directly, or by unauthenticated attackers if chained with other vulnerabilities such as CVE-2023-3533 (arbitrary file write).
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows attackers to execute arbitrary code on the server, leading to full compromise of the affected Chamilo LMS instance. Attackers can gain persistent access, exfiltrate data, or use the server as a foothold for further attacks.
If you can’t patch tonight, do this now.
As an interim measure, restrict upload of .htaccess files and configure the web server to ignore .htaccess files in upload directories. Additionally, apply least privilege principles to file upload directories and monitor for suspicious file uploads.
Patch, then assume compromise.
Upgrade Chamilo LMS to a version later than 1.11.20 where this vulnerability is patched. Ensure that file upload sanitization is properly implemented and that .htaccess files cannot be uploaded or interpreted in upload directories.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.