PT-2023-28292 · Unknown · Chamilo Lms

Creastery + 1 · Publicado 2023-11-28 · Atualizado 2024-11-03 · CVE-2023-4220

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.24

Description The issue allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell, specifically through the big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php. This has been exploited in real-world incidents, such as the PermX machine on HackTheBox, where attackers used subdomain enumeration to discover a vulnerable Chamilo LMS instance, and then abused a bash script with sudo privileges to gain root access.

Recommendations For versions prior to 1.11.24, update to version 1.11.24 or later to resolve the issue. As a temporary workaround, consider disabling the big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php until a patch is available. Restrict access to the /main/inc/lib/javascript/bigupload/inc/bigUpload.php file to minimize the risk of exploitation. Avoid using the big file upload functionality until the issue is resolved.

Exploit

Correção

RCE

XSS

Unrestricted File Upload

Enumeração de Fraquezas

CWE-79

CWE-434

Identificadores relacionados

CVE-2023-4220

Produtos afetados

Chamilo Lms

Referências · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/chamilo_bigupload_webshell.rb · Exploit
• 🔥 https://github.com/m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc · Exploit
• 🔥 https://github.com/Ziad-Sakr/Chamilo-CVE-2023-4220-Exploit · Exploit
• 🔥 https://github.com/insomnia-jacob/CVE-2023-4220 · Exploit
• 🔥 https://starlabs.sg/advisories/23/23-4220 · Exploit
• https://github.com/chamilo/chamilo-lms/commit/3b487a55076fb06f96809b790a35dcdd42f8ec49 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-4220 · Nota de Segurança
• https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-130-2023-09-04-Critical-impact-High-risk-Unauthenticated-users-may-gain-XSS-and-unauthenticated-RCE-CVE-2023-4220 · Aviso do Fabricante
• https://twitter.com/insomniadev_/status/1810359257704906968 · Publicação no Twitter
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4220 · Nota
• https://twitter.com/mr_kaito_2019/status/1848390601366024545 · Publicação no Twitter
• https://twitter.com/_kujen5/status/1852996418190909947 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-4220 · Aviso do Fabricante