CVE-2023-3368
📋 TL;DR
CVE-2023-3368 is an unauthenticated command injection vulnerability in Chamilo LMS that allows remote attackers to execute arbitrary commands on affected systems. This vulnerability affects Chamilo LMS versions up to and including v1.11.20. Attackers can exploit this flaw without any authentication, making it particularly dangerous.
💻 Affected Systems
- Chamilo LMS
📦 What is this software?
Chamilo by Chamilo
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the server, data theft, installation of persistent backdoors, and lateral movement to other systems.
Likely Case
Remote code execution leading to web shell deployment, data exfiltration, cryptocurrency mining, or ransomware deployment.
If Mitigated
Limited impact due to network segmentation, minimal privileges, and proper monitoring detecting exploitation attempts.
🎯 Exploit Status
Exploitation is straightforward with public proof-of-concept available. This is a bypass of the previous CVE-2023-34960 fix.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.11.21 and later
Restart Required: No
Instructions:
1. Backup your Chamilo installation and database. 2. Download the latest version from the official Chamilo website. 3. Replace the vulnerable file /main/webservices/additional_webservices.php with the patched version. 4. Verify the fix by checking the file hash matches the official patch.
🔧 Temporary Workarounds
File Access Restriction
allRestrict access to the vulnerable PHP file using web server configuration
# For Apache: add to .htaccess
<Files "additional_webservices.php">
Order deny,allow
Deny from all
</Files>
# For Nginx: add to server block
location ~ /main/webservices/additional_webservices\.php$ {
deny all;
return 403;
}
Input Validation Enhancement
allAdd additional input validation to sanitize user input before processing
# Add to the beginning of additional_webservices.php
function sanitize_input($input) {
return escapeshellarg($input);
}
# Apply to all user-controlled variables before shell execution
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the Chamilo server from critical systems
- Deploy a web application firewall (WAF) with command injection detection rules
🔍 How to Verify
Check if Vulnerable:
Check if /main/webservices/additional_webservices.php exists and contains the vulnerable code patterns from the advisoryCheck Version:
grep "\$version" main/inc/conf/configuration.php | head -1Verify Fix Applied:
Verify the file hash of /main/webservices/additional_webservices.php matches the patched version from the official repository📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /main/webservices/additional_webservices.php
- Shell command execution patterns in web server logs
- Multiple failed exploitation attempts
Network Indicators:
- Unusual outbound connections from the Chamilo server
- Traffic patterns indicating command and control communication
SIEM Query:
source="web_server" AND (url="/main/webservices/additional_webservices.php" OR cmd="*;*" OR cmd="*|*" OR cmd="*`*" OR cmd="*$(*")🔗 References
- https://github.com/chamilo/chamilo-lms/commit/37be9ce7243a30259047dd4517c48ff8b21d657a
- https://https://github.com/chamilo/chamilo-lms/commit/4c69b294f927db62092e01b70ac9bd6e32d5b48b
- https://starlabs.sg/advisories/23/23-3368/
- https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-121-2023-07-05-Critical-impact-High-risk-Unauthenticated-Command-Injection-CVE-2023-3368
- https://github.com/chamilo/chamilo-lms/commit/37be9ce7243a30259047dd4517c48ff8b21d657a
- https://https://github.com/chamilo/chamilo-lms/commit/4c69b294f927db62092e01b70ac9bd6e32d5b48b
- https://starlabs.sg/advisories/23/23-3368/
- https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-121-2023-07-05-Critical-impact-High-risk-Unauthenticated-Command-Injection-CVE-2023-3368
