Chamilo LMS: CVE-2024-27524 & CVE-2024-27525

CVE-2024-27524: Stored XSS in tickets

Severity: High (Base Score 7.1)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H 

Mitigation: Upgrade to Chamilo LMS 1.11.28 and above.

Patch: https://github.com/chamilo/chamilo-lms/commit/53275c152275958b33a1f87a21843daa52fb543a

CVE-2024-27525: Self XSS in social network

Base Score: Medium (Base Score 4.6)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Mitigation: Upgrade to Chamilo LMS 1.11.28 and above.

Patch: https://github.com/chamilo/chamilo-lms/commit/a63e03ef961e7bf2dab56f4ede6f87edef40ba0c

Overview

This advisory covers the discovery of two vulnerabilities within Chamilo LMS, an open-source learning management system (LMS) widely used across educational institutions. These vulnerabilities—stored cross-site scripting (Stored XSS) and self-cross-site scripting (Self XSS)—pose different levels of security risks but highlight critical considerations for secure system administration and user protection.

Summary of Vulnerabilities

Both vulnerabilities were responsibly disclosed, with Chamilo's development team implementing necessary patches to mitigate potential exploits. It’s advised for all users to update to Chamilo LMS version 1.11.28 or above to prevent exploitation.

Detailed Vulnerability Analysis

Stored XSS (CVE-2024-27524)

Severity: High

Description: This Stored XSS vulnerability, identified within the ticketing module, allows attackers to inject malicious code directly into the Chamilo LMS environment.

Attack Vector: An attacker can use the following vulnerable endpoint to execute malicious code whenever a user accesses or interacts with compromised data:

http://chamilo-lms.local/main/ticket/new_ticket.php?project_id=1&

Payload Example: <img src=x onerror=alert(1) >.png

  Listing 1: Create a new project ticket with malicious script

Stored XSS vulnerabilities are especially concerning, as they allow the attacker’s script to persist in the application, presenting a severe risk of data theft, session hijacking, and unauthorized redirection. Users accessing the infected area unknowingly execute the script, which could lead to potential loss of control over their accounts.

Listing 2: Triggering the Stored XSS vulnerability

Self XSS (CVE-2024-27525)

Severity: Medium

Description: The Self XSS vulnerability is found in Chamilo’s social network module and requires a user’s active input to execute the script, making it a somewhat lower-risk issue.

Attack Vector: Users are vulnerable when interacting with the following endpoint, allowing the code to run within their own session but requiring intentional triggering:

http://chamilo-lms.local/main/social/home.php

Payload Example: <img src=x onerror="alert(1)">.png

Listing 3: Triggering the Self XSS vulnerability through user interaction

While Self XSS poses less of a threat due to its dependency on user initiation, it can still serve as a gateway for social engineering attacks, where users unknowingly enable the malicious script by engaging with the embedded link or script.

Recommendations for Users and Administrators

To mitigate these vulnerabilities, it is critical to upgrade to Chamilo LMS 1.11.28 or later. The update includes patches addressing these XSS vulnerabilities to protect both administrators and users from potential exploitation. Here are additional security best practices:

1.Update Regularly: Ensure all Chamilo LMS instances are updated promptly upon the release of security patches.

2.Review User Permissions: Restrict permissions to limit potential exposure to high-privileged users.

3.Implement Security Training: Educate users on the risks of XSS, particularly in environments with social networking or ticketing features.

Final Thoughts

The discovery of these vulnerabilities underscores the importance of consistent security monitoring and collaboration within the open-source community. Working with the Chamilo team on these issues has been a reminder of the shared commitment to securing digital learning tools that empower institutions worldwide. We extend this advisory to all Chamilo users to reinforce their system’s defenses and urge proactive steps to protect the integrity of educational platforms.

Acknowledgments: Ι thank Chamilo’s development team for their swift collaboration and response, setting an example of dedication to the security of open-source software.

This Article Was Sponsored By: