{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-34160/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-34160"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["chamilo","ssrf","cve-2026-34160","lms"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eChamilo LMS, an open-source learning management system, is vulnerable to a Server-Side Request Forgery (SSRF) flaw in versions prior to 2.0.0-RC.3. The vulnerability resides within the PENS plugin endpoint at \u003ccode\u003epublic/plugin/Pens/pens.php\u003c/code\u003e, which is accessible without authentication. The \u003ccode\u003epackage-url\u003c/code\u003e parameter is not properly validated, allowing an attacker to specify arbitrary URLs for the server to fetch using curl. This enables unauthenticated attackers to probe internal network services, access cloud metadata endpoints like \u003ccode\u003e169.254.169.254\u003c/code\u003e to potentially steal IAM credentials, and trigger state-changing operations on internal services via callback parameters. The absence of authentication requirements significantly broadens the attack surface. The vulnerability is identified as CVE-2026-34160 and has been fixed in version 2.0.0-RC.3.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a Chamilo LMS instance running a vulnerable version (prior to 2.0.0-RC.3).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP request targeting the \u003ccode\u003epublic/plugin/Pens/pens.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe request includes the \u003ccode\u003epackage-url\u003c/code\u003e parameter, set to an internal IP address or cloud metadata endpoint (e.g., \u003ccode\u003e169.254.169.254\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe Chamilo server, using curl, fetches the URL specified in the \u003ccode\u003epackage-url\u003c/code\u003e parameter without proper validation.\u003c/li\u003e\n\u003cli\u003eIf targeting an internal service, the attacker probes for open ports and accessible services.\u003c/li\u003e\n\u003cli\u003eIf targeting a cloud metadata endpoint, the attacker retrieves sensitive information like IAM roles and instance metadata.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the retrieved IAM credentials to access other cloud resources.\u003c/li\u003e\n\u003cli\u003eAlternatively, the attacker manipulates receipt and alerts callback parameters to trigger state-changing operations on internal services.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this SSRF vulnerability allows attackers to gain unauthorized access to internal network resources and sensitive cloud metadata. This can lead to lateral movement within the internal network, data exfiltration of IAM credentials, or compromise of cloud infrastructure. The vulnerability affects all Chamilo LMS instances running versions prior to 2.0.0-RC.3. The impact can range from information disclosure to full compromise of the affected system and associated cloud resources.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Chamilo LMS to version 2.0.0-RC.3 or later to remediate CVE-2026-34160.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Chamilo LMS SSRF Attempt via Package URL\u003c/code\u003e to identify attempts to exploit the SSRF vulnerability by monitoring for requests to \u003ccode\u003epublic/plugin/Pens/pens.php\u003c/code\u003e with suspicious \u003ccode\u003epackage-url\u003c/code\u003e values.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests to the PENS plugin endpoint (\u003ccode\u003epublic/plugin/Pens/pens.php\u003c/code\u003e) containing the IP address \u003ccode\u003e169.254.169.254\u003c/code\u003e in the \u003ccode\u003epackage-url\u003c/code\u003e parameter to detect access attempts to cloud metadata endpoints.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation and restrict access to internal services from the Chamilo LMS server to limit the impact of potential SSRF attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-15T12:00:00Z","date_published":"2026-04-15T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-15-chamilo-ssrf/","summary":"An unauthenticated server-side request forgery (SSRF) vulnerability exists in Chamilo LMS versions prior to 2.0.0-RC.3, allowing attackers to probe internal network services, access cloud metadata, or trigger state-changing operations on internal services.","title":"Chamilo LMS Unauthenticated SSRF Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-04-15-chamilo-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-34160","version":"https://jsonfeed.org/version/1.1"}