CVE-2023-45868
📋 TL;DR
CVE-2023-45868 is a directory traversal vulnerability in ILIAS Learning Module 7.25 that allows authenticated attackers to relocate directories outside the document root to publicly accessible locations using manipulated POST requests. This exposes sensitive files and can cause denial of service by making original files unavailable. Organizations running ILIAS 7.25 with the Learning Module enabled are affected.
💻 Affected Systems
- ILIAS Learning Management System
📦 What is this software?
Ilias by Ilias
⚠️ Risk & Real-World Impact
Worst Case
Complete exposure of sensitive system files (configuration files, credentials, databases) and denial of service for critical ILIAS components and underlying OS services.
Likely Case
Exposure of sensitive ILIAS data (user information, course materials) and disruption of specific learning modules through file relocation.
If Mitigated
Limited impact with proper input validation and file permission restrictions preventing directory traversal.
🎯 Exploit Status
Exploit requires authenticated user access and manipulation of POST parameters during exercise unit creation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ILIAS 7.25.1 or later
Vendor Advisory: https://docu.ilias.de/goto_docu_pg_145918_4791.html
Restart Required: No
Instructions:
1. Backup ILIAS installation and database. 2. Download latest ILIAS version from official repository. 3. Replace affected files with patched version. 4. Run ILIAS update script. 5. Verify Learning Module functionality.
🔧 Temporary Workarounds
Disable Learning Module
allTemporarily disable the vulnerable Learning Module component
# Edit ILIAS configuration to disable Learning Module
# Specific commands depend on ILIAS installation method
Input Validation WAF Rule
linuxImplement web application firewall rules to block directory traversal patterns in POST requests
# Example ModSecurity rule:
SecRule ARGS "\.\./" "id:1001,phase:2,deny,msg:'Directory Traversal Attempt'
🧯 If You Can't Patch
- Implement strict input validation for all POST parameters in the Learning Module
- Restrict file system permissions to prevent PHP from moving directories outside document root
🔍 How to Verify
Check if Vulnerable:
Check ILIAS version in administration panel or by examining the ILIAS installation directory for version files. Verify if running 7.25 (2023-09-12 release).Check Version:
Check ILIAS version via web interface at /ilias.php?baseClass=ilAdministrationGUI or examine ilInitialisation.php fileVerify Fix Applied:
After patching, attempt to reproduce the vulnerability by creating an exercise unit with directory traversal payloads in old_name/new_name parameters.📡 Detection & Monitoring
Log Indicators:
- POST requests to Learning Module with ../ patterns in parameters
- PHP rename() function errors showing path traversal attempts
- Unexpected file system operations in ILIAS directories
Network Indicators:
- HTTP POST requests containing directory traversal sequences (\.\./) to exercise creation endpoints
SIEM Query:
source="web_logs" AND (uri_path="*LearningModule*" OR uri_path="*exercise*" OR uri_path="*ilExerciseHandler*" OR uri_path="*ilObjExerciseGUI*") AND http_method="POST" AND (request_body LIKE "%..%" OR request_body LIKE "%old_name%" OR request_body LIKE "%new_name%")