Loading vulnerability…
Authenticated Remote Code Execution via Unrestricted File Upload in Chamilo LMS
CVE-2023-4226 is an unrestricted file-upload vulnerability in Chamilo LMS versions through 1.11.24. The affected AJAX upload handler insufficiently restricts uploaded file types and constructs upload destinations from user-supplied filenames without adequate sanitization. A learner-role user can upload server-executable content and alter upload-directory configuration, enabling execution of attacker-controlled code by the web server. The flaw can also be used to store malicious HTML content for cross-site scripting attacks.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation provides remote code execution in the web-server security context. An attacker can also use unrestricted HTML uploads to conduct stored cross-site scripting, potentially affecting users who access the uploaded content.
If you can’t patch tonight, do this now.
If an upgrade cannot be applied immediately, sanitize user-controlled upload filenames and enforce an allowlist of safe file types. Block server-executable files and upload-directory configuration files, and additionally block HTML uploads to prevent stored cross-site scripting. Configure the upload directory to deny script execution and content sniffing, and review it for unauthorized executable content or altered configuration.
Patch, then assume compromise.
Upgrade Chamilo LMS to version 1.11.26 or later, which includes the complete fix released on September 27, 2023.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.