CVE-2021-43136
📋 TL;DR
CVE-2021-43136 is an authentication bypass vulnerability in FormaLMS learning management systems that allows attackers to gain unauthorized access to the platform without valid credentials. This affects all organizations running vulnerable versions of FormaLMS, potentially exposing sensitive student data, course materials, and administrative functions.
💻 Affected Systems
- FormaLMS
📦 What is this software?
Formalms by Formalms
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the FormaLMS instance with administrative access, allowing data theft, manipulation of courses and grades, installation of backdoors, and lateral movement to connected systems.
Likely Case
Unauthorized access to user accounts, theft of sensitive educational data, manipulation of course content, and potential privilege escalation to administrative functions.
If Mitigated
Limited impact with proper network segmentation, strong authentication requirements for sensitive functions, and regular monitoring for unauthorized access attempts.
🎯 Exploit Status
Public exploit details available on Packet Storm Security and Hacktive Security blog. The attack requires no authentication and minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.5 and later
Vendor Advisory: https://formalms.org
Restart Required: No
Instructions:
1. Backup your FormaLMS installation and database. 2. Download FormaLMS version 2.4.5 or later from the official website. 3. Replace the vulnerable files with the patched version. 4. Verify the installation is working correctly.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock requests containing the specific parameter manipulation used in the exploit
Add WAF rule to block requests with suspicious authentication parameters
Access Restriction
allRestrict access to FormaLMS to trusted IP ranges only
Configure firewall rules to allow only authorized IP addresses to access FormaLMS
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FormaLMS from critical systems
- Enable detailed logging and monitoring for authentication attempts and implement alerting for suspicious activities
🔍 How to Verify
Check if Vulnerable:
Check if your FormaLMS version is 2.4.4 or earlier by examining the version file or admin panelCheck Version:
Check the FormaLMS admin panel or examine the version.txt file in the installation directoryVerify Fix Applied:
Verify the version is 2.4.5 or later and test authentication functionality📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns
- Multiple failed login attempts followed by successful access from same IP
- Access to admin functions from non-admin accounts
Network Indicators:
- HTTP requests with manipulated authentication parameters
- Unusual traffic patterns to authentication endpoints
SIEM Query:
source="formalms_logs" AND (event_type="authentication" AND result="success" AND user_agent="*exploit*" OR parameter="*auth_bypass*"))🔗 References
- http://packetstormsecurity.com/files/164930/FormaLMS-2.4.4-Authentication-Bypass.html
- https://blog.hacktivesecurity.com
- https://blog.hacktivesecurity.com/index.php/2021/10/05/cve-2021-43136-formalms-the-evil-default-value-that-leads-to-authentication-bypass/
- https://formalms.org
- http://packetstormsecurity.com/files/164930/FormaLMS-2.4.4-Authentication-Bypass.html
- https://blog.hacktivesecurity.com
- https://blog.hacktivesecurity.com/index.php/2021/10/05/cve-2021-43136-formalms-the-evil-default-value-that-leads-to-authentication-bypass/
- https://formalms.org
