Loading vulnerability…
Authenticated RCE via Unrestricted File Upload in Chamilo LMS
CVE-2023-4223 is an unrestricted file-upload vulnerability in the Chamilo LMS document AJAX upload handler affecting versions through 1.11.24. The handler writes attacker-controlled uploads using user-supplied filenames without adequate validation or dangerous file-type restrictions. A learner-role account can upload server-side code and modify web-server configuration in a web-accessible, server-writable cache location, enabling execution of attacker-controlled commands. The same weakness can also support stored cross-site scripting through malicious uploaded content.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated learner can obtain remote code execution in the web-server process context by uploading server-side code and enabling its execution. The vulnerability also permits modification of upload-related server configuration and can enable stored cross-site scripting through uploaded malicious content.
If you can’t patch tonight, do this now.
Until upgrades are complete, restrict learner access to the affected upload functionality, prevent execution of uploaded content in web-accessible cache or archive locations, and prohibit modification of web-server configuration files by the application upload process. Apply server rules that deny direct access to uploaded content and set the X-Content-Type-Options: nosniff header. Review access logs for requests to the document upload handler and web-accessible cache content, and investigate unexpected server-side scripts or modified web-server configuration files in the upload destination.
Patch, then assume compromise.
Upgrade Chamilo LMS to version 1.11.26 or later, which contains the complete fix. Ensure upload handling sanitizes user-supplied filenames and rejects dangerous file types, including server-side script, web-server configuration, and HTML content. The documented remediation recommends using api_replace_dangerous_char() and enhancing disable_dangerous_file() in the file-upload library to block HTML uploads as well as dangerous script and configuration files.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.