Chamilo LMS - CraftedSignal Threat Feed

Chamilo LMS Unrestricted File Upload Leads to Remote Code Execution

hello@craftedsignal.io — Mon, 29 Jan 2024 12:00:00 +0000

Chamilo LMS, a learning management system, is vulnerable to an unrestricted file upload (CVE-2026-32931). This flaw affects versions prior to 1.11.38 and 2.0.0-RC.3. A teacher, after successful authentication, can exploit the exercise sound upload function to inject a PHP webshell. By manipulating the Content-Type header to appear as "audio/mpeg", the attacker bypasses file type restrictions. The malicious PHP file is then stored in a publicly accessible web directory. This leads to remote code execution, granting the attacker control with the privileges of the web server user (www-data). Successful exploitation allows attackers to compromise the Chamilo LMS server, potentially leading to data theft, defacement, or further lateral movement within the network.

Attack Chain

The attacker authenticates to the Chamilo LMS as a teacher.
The attacker navigates to the exercise sound upload function within the Chamilo LMS interface.
The attacker crafts a malicious PHP webshell (e.g., evil.php).
The attacker intercepts the file upload request and modifies the Content-Type header to audio/mpeg.
The attacker uploads the PHP webshell, which is then saved with its original .php extension to a web-accessible directory on the server.
The attacker accesses the uploaded PHP webshell (e.g., /upload/evil.php) via a web browser.
The PHP webshell executes arbitrary commands on the server with the privileges of the web server user (www-data).
The attacker can then use the webshell for further malicious activities such as reconnaissance, lateral movement, or data exfiltration.

Impact

Successful exploitation of CVE-2026-32931 allows an attacker to execute arbitrary code on the Chamilo LMS server. The attacker gains control with the privileges of the web server user, potentially leading to sensitive data theft, complete system compromise, or further attacks on internal infrastructure. Given the nature of LMS systems, this could expose student records, course materials, and other confidential information, leading to a significant breach of privacy and security.

Recommendation

Upgrade Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 to patch CVE-2026-32931.
Implement web application firewall (WAF) rules to inspect and block file uploads with suspicious Content-Type headers that do not match the file extension.
Monitor web server logs for access to unusual PHP files in upload directories, which may indicate successful exploitation. Deploy the provided Sigma rule to assist in this monitoring.
Implement strict file upload policies and validate file types on the server side, regardless of the Content-Type header provided by the client.

Chamilo LMS Remote Code Execution via Arbitrary File Upload (CVE-2026-33704)

hello@craftedsignal.io — Wed, 24 Jan 2024 12:00:00 +0000

Chamilo LMS, a learning management system, is vulnerable to a critical remote code execution (RCE) flaw identified as CVE-2026-33704. This vulnerability affects versions prior to 1.11.38. An authenticated user, including students, can exploit this vulnerability by writing arbitrary content to files on the server using the BigUpload endpoint. The vulnerability lies in the insufficient filtering of file extensions. While the .php extension is filtered and converted to .phps, the .pht extension is not modified. If the Apache web server is configured to handle .pht files as PHP, this can lead to arbitrary code execution. The vulnerability was patched in version 1.11.38. Exploitation allows attackers to compromise the web server hosting the Chamilo LMS instance.

Attack Chain

An attacker authenticates to the Chamilo LMS as a legitimate user (e.g., student).
The attacker crafts a malicious HTTP POST request targeting the BigUpload endpoint.
The request includes a key parameter specifying the desired filename, using a .pht extension.
The request body contains arbitrary PHP code that the attacker wants to execute on the server.
The Chamilo LMS application processes the request but fails to properly sanitize the .pht extension.
The application writes the attacker-controlled PHP code to a file with a .pht extension in the web server's document root or accessible directory.
The attacker sends an HTTP request to the newly created .pht file.
The Apache web server, if configured to process .pht files as PHP, executes the attacker-supplied code, leading to remote code execution.

Impact

Successful exploitation of CVE-2026-33704 allows an attacker to execute arbitrary code on the Chamilo LMS server. This could lead to complete system compromise, data theft, defacement of the learning platform, or further malicious activities within the network. Given the nature of an LMS, student and faculty data, including personal information and academic records, could be exposed. There are no specific victim counts available but successful exploitation grants complete control of the Chamilo LMS instance.

Recommendation

Upgrade Chamilo LMS to version 1.11.38 or later to patch CVE-2026-33704.
Configure the Apache web server to not execute .pht files as PHP. This mitigation can be implemented even without patching.
Deploy the Sigma rule Chamilo_BigUpload_PHT_File_Creation to detect the creation of .pht files via the BigUpload endpoint.
Monitor web server access logs for requests to .pht files in the Chamilo LMS web directory using the Chamilo_PHT_File_Access Sigma rule.