PT-2024-25299 · Ilias · Ilias

Daniel Schlecht · Published 2024-05-21 · Updated 2024-07-03 · CVE-2024-33529

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ILIAS versions 7.0 through 7.29 ILIAS versions 8.0 through 8.10 ILIAS version 9.0

Description The issue allows remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous types. This can be achieved by uploading files of certain types that are not properly validated, leading to potential system compromise.

Recommendations For ILIAS versions 7.0 through 7.29, update to version 7.30 or later. For ILIAS versions 8.0 through 8.10, update to version 8.11 or later. For ILIAS version 9.0, consider restricting file uploads or disabling administrative privileges until a patch is available. As a temporary workaround, consider disabling the file upload feature for administrative users to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-33529

Affected Products

Ilias

References · 6

• 🔥 https://insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-11-v9-1 · Exploit
• https://osv.dev/vulnerability/CVE-2024-33529 · Vendor Advisory
• https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170040 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-33529 · Security Note
• https://twitter.com/CVEnew/status/1793284038498959512 · Twitter Post
• https://t.me/cvenotify/80888 · Telegram Post