PT-2023-28292 · Unknown · Chamilo Lms

Creastery + 1 · Published 2023-11-28 · Updated 2024-11-03 · CVE-2023-4220

Positive Technologies · (AI Summary)

CVSS v3.1

8.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

Chamilo LMS versions prior to 1.11.24

Description:

The issue allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell, specifically through the big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php`. This has been exploited in real-world incidents, such as the PermX machine on HackTheBox, where attackers used subdomain enumeration to discover a vulnerable Chamilo LMS instance, and then abused a bash script with sudo privileges to gain root access.

Recommendations:

For versions prior to 1.11.24, update to version 1.11.24 or later to resolve the issue. As a temporary workaround, consider disabling the big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` until a patch is available. Restrict access to the `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` file to minimize the risk of exploitation. Avoid using the big file upload functionality until the issue is resolved.

Exploit

Fix

RCE

Unrestricted File Upload

XSS

Weakness Enumeration

CWE-434

CWE-79

Related Identifiers

CVE-2023-4220

Affected Products

Chamilo Lms

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/chamilo_bigupload_webshell.rb · Exploit
• 🔥 https://github.com/m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc · Exploit
• 🔥 https://github.com/Ziad-Sakr/Chamilo-CVE-2023-4220-Exploit · Exploit
• 🔥 https://github.com/insomnia-jacob/CVE-2023-4220 · Exploit
• 🔥 https://starlabs.sg/advisories/23/23-4220 · Exploit
• https://github.com/chamilo/chamilo-lms/commit/3b487a55076fb06f96809b790a35dcdd42f8ec49 · Patch
• https://osv.dev/vulnerability/CVE-2023-4220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4220 · Security Note
• https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-130-2023-09-04-Critical-impact-High-risk-Unauthenticated-users-may-gain-XSS-and-unauthenticated-RCE-CVE-2023-4220 · Vendor Advisory
• https://twitter.com/mr_kaito_2019/status/1848390601366024545 · Twitter Post
• https://twitter.com/insomniadev_/status/1810359257704906968 · Twitter Post
• https://twitter.com/_kujen5/status/1852996418190909947 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4220 · Note