PT-2023-8583 · Ilias · Ilias

Published 2023-06-19 · Updated 2024-02-14 · CVE-2023-36485

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ILIAS versions prior to 7.23 ILIAS versions 8 prior to 8.3

Description The issue is related to insufficient input validation in the workflow-engine of ILIAS, allowing remote authenticated users to execute arbitrary system commands on the application server as the application user. This can be achieved by using a malicious BPMN2 workflow definition file.

Recommendations For ILIAS versions prior to 7.23, update to version 7.23 or later to resolve the issue. For ILIAS versions 8 prior to 8.3, update to version 8.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the workflow-engine to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-01224

CVE-2023-36485

Affected Products

Ilias

References · 11

• https://github.com/ILIAS-eLearning/ILIAS/pull/5987 · Patch
• https://github.com/ILIAS-eLearning/ILIAS/pull/5988 · Patch
• https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=xd:kx:54&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=3439&prvm=fsc&bmn=2023-12&blpg=786 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01224 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36485 · Security Note
• https://t.me/cvenotify/66129 · Telegram Post
• https://t.me/cvenotify/71360 · Telegram Post
• https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=xd:kx:54&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=3439&prvm=fsc&bmn=2023-12&blpg=786 · Note
• https://t.me/cvenotify/65102 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1739246991513710747 · Twitter Post