HighPublic exploit

Command Injection in Chamilo LMS openoffice_presentation.class.php

IdentifiersCVE-2023-4221CWE-78· Improper Neutralization of Special…

CVE-2023-4221 is a command injection vulnerability in Chamilo LMS affecting versions up to and including 1.11.24. The flaw is in main/lp/openoffice_presentation.class.php and is reachable through the learning-path upload workflow in main/lp/lp_upload.php. In the vulnerable path, user-controlled slide_size input is split into slide_width and slide_height in OpenofficeDocument::convert_document() without type-casting or sanitization, and OpenofficePresentation::add_command_parameters() appends those values directly into an OS command. When Chamilo RAPID is enabled and the service_ppt2lp host is configured as localhost, the application executes the constructed command via exec(), allowing shell metacharacters in slide_size to trigger arbitrary command execution. The issue affects users with permission to upload Learning Paths, such as a Trainer-role user, and appears to be a variant of CVE-2023-34960.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in remote code execution in the security context of the Chamilo application on the target server. An authenticated attacker with learning-path upload privileges can execute arbitrary shell commands, which can lead to full compromise of confidentiality, integrity, and availability of the affected host and application data. The provided proof of concept demonstrates execution of the id command and creation of a server-side file (/tmp/rce), confirming arbitrary command execution capability.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, disable or restrict the vulnerable learning-path conversion workflow. In particular, reduce access to Learning Path upload functionality to only strictly necessary trusted users, disable Chamilo RAPID if operationally feasible, and avoid configuring service_ppt2lp to localhost where this vulnerable local exec path is used. Monitor and review requests to /main/lp/lp_upload.php, /main/lp/lp_controller.php, /main/upload/upload_ppt.php, /main/upload/upload_upload.php, and /main/upload/upload.scorm.php, with emphasis on requests containing a non-empty ppt2lp parameter and suspicious slide_size values containing shell metacharacters.

Remediation

Patch, then assume compromise.

Upgrade Chamilo LMS to version 1.11.26 or later, as Chamilo released a complete fix in v1.11.26 on 2023-09-27. The vulnerable command construction should be corrected by properly escaping shell arguments, for example with escapeshellarg(), and by avoiding direct inclusion of user-controlled values in OS command strings. Review adjacent upload and document-conversion code paths for similar command-construction flaws, especially variants related to CVE-2023-4222 and CVE-2023-34960.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

ChamiloChamilo Lmsapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

starlabs sgNews

Nov 28, 2023

(CVE-2023-4222) Chamilo LMS Learning Path PPT2LP OpenofficeTextDocument Command Injection | STAR Labs

A command injection vulnerability in Chamilo LMS main/lp/openoffice_presentation.class.php, described as a related variant alongside CVE-2023-4222.

starlabs sgNews

Nov 28, 2023

(CVE-2023-4221) Chamilo LMS Learning Path PPT2LP OpenofficePresentation Command Injection | STAR Labs

A command injection vulnerability in Chamilo LMS main/lp/openoffice_presentation.class.php that can lead to remote code execution for users with permissions to upload learning paths under specific configuration conditions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity