CVE-2021–40662 Chamilo LMS 1.11.14 RCE
This is Febin, a Security Researcher. This article is about my third CVE that I got for finding a Remote Code Execution in a popular Learning Management Software named “Chamilo LMS”.
This is a chained exploit. First, I found a CSRF in the plugin upload feature which leads to Remote Code Execution which is then combined with a stored XSS to achieve Zero-click RCE.
XSS + CSRF + Malicious Plugin Upload = RCE. Boom!
Product Information: Chamilo is an e-learning platform, also called “LMS”, published under the GNU/GPLv3+ license. It has been used by more than 30M people worldwide since its inception in 2010.
Vendor Homepage: https://chamilo.org/en/
July 27, 2021 — Contacted the vendor and reported the vulnerability
July 28, 2021 — Vendor replies back
August 2, 2021 — Vulnerability has been patched in version 1.11.16
March 21, 2022 — CVE ID was assigned. CVE-2021–40662
CVE Description: Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker’s profile page.
- One-Click Technique: An Attacker who has a student account can create a malicious web page or a malicious SVG image file and upload the file to the “My Productions” section of the student profile page, then he can copy the URL of that file and send it to the Chamilo Admin User. When the Admin user loads the file in his browser with an active chamilo session, in the background it will upload a plugin (.zip file) to chamilo. Then the attacker can simply navigate to /plugin/exploited-directory/ and execute malicious commands.
The Vulnerability has been patched from version 1.11.16
Social: Security token for chat and social wall · chamilo/chamilo-lms@c75b06a
Chamilo is a learning management system focused on ease of use and accessibility - Social: Security token for chat and…
Table of contents Security issues Security track record Security flaws reporting procedure Security flaws fixing…