CVE-2021-41152
📋 TL;DR
CVE-2021-41152 is a path traversal vulnerability in OpenOlat that allows authenticated users to read arbitrary files on the server by manipulating HTTP requests in the folder component. The vulnerability affects OpenOlat versions before 15.5.8 and 16.0.1, requiring either a user account or enabled guest access with folder component usage.
💻 Affected Systems
- OpenOlat
📦 What is this software?
Openolat by Frentix
⚠️ Risk & Real-World Impact
Worst Case
An attacker could read sensitive system files, configuration files, or database credentials, potentially leading to full system compromise if privileged files are accessible.
Likely Case
Attackers with valid accounts could read OpenOlat configuration files, user data, or other web-accessible files, potentially enabling further attacks or data exfiltration.
If Mitigated
With proper file permissions and application server user restrictions, impact is limited to files within the web root or specific accessible directories.
🎯 Exploit Status
Exploitation requires HTTP request manipulation but is straightforward for attackers with valid credentials
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.5.8 or 16.0.1
Vendor Advisory: https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-m8j5-837g-2p3f
Restart Required: Yes
Instructions:
1. Backup your OpenOlat installation and database. 2. Download OpenOlat version 15.5.8 or 16.0.1 from the official repository. 3. Replace the existing installation with the patched version. 4. Restart the application server. 5. Verify the fix by checking the version.
🧯 If You Can't Patch
- Restrict file system permissions for the application server user to minimal required directories
- Disable guest user access and monitor for suspicious file access patterns
🔍 How to Verify
Check if Vulnerable:
Check OpenOlat version via admin interface or by examining the installation directory for version filesCheck Version:
Check the WEB-INF/lib directory for openolat-core-*.jar version or use admin interfaceVerify Fix Applied:
Verify the version is 15.5.8 or higher for 15.x branch, or 16.0.1 or higher for 16.x branch📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Requests with path traversal sequences (../) to folder component endpoints
Network Indicators:
- HTTP requests containing path traversal sequences to /olat/ folder component URLs
SIEM Query:
web.url:*../* AND web.url:*folder* AND web.url:*olat*🔗 References
- https://github.com/OpenOLAT/OpenOLAT/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb
- https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-m8j5-837g-2p3f
- https://jira.openolat.org/browse/OO-5696
- https://github.com/OpenOLAT/OpenOLAT/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb
- https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-m8j5-837g-2p3f
- https://jira.openolat.org/browse/OO-5696
