CVE-2023-45880
📋 TL;DR
This vulnerability allows attackers to perform directory traversal in GibbonEdu's report template builder, enabling them to create arbitrary PHP files in the webroot directory. This affects all GibbonEdu installations up to version 25.0.0, potentially leading to remote code execution.
💻 Affected Systems
- GibbonEdu
📦 What is this software?
Gibbon by Gibbonedu
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or ransomware deployment.
Likely Case
Webshell deployment allowing persistent access, data theft, or lateral movement within the network.
If Mitigated
Limited impact if proper file upload restrictions and web application firewalls are in place.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 25.0.1 or later
Vendor Advisory: https://github.com/GibbonEdu/core/security/advisories/GHSA-4q8c-8j9f-5q5q
Restart Required: No
Instructions:
1. Backup your GibbonEdu installation and database. 2. Download and install GibbonEdu version 25.0.1 or later. 3. Replace all files with the new version. 4. Run the update script if prompted.
🔧 Temporary Workarounds
Restrict Asset Component Creation
allTemporarily disable or restrict permissions for creating Asset Components in the report template builder.
Web Application Firewall Rules
allImplement WAF rules to block directory traversal patterns in templateFileDestination parameter.
🧯 If You Can't Patch
- Implement strict file upload validation to prevent PHP file creation outside designated directories.
- Monitor webroot directory for unauthorized PHP file creation and implement file integrity monitoring.
🔍 How to Verify
Check if Vulnerable:
Check if GibbonEdu version is 25.0.0 or earlier by reviewing the version in the admin interface or checking the core/version.php file.Check Version:
grep "\$version" /path/to/gibbon/core/version.phpVerify Fix Applied:
Verify installation is running version 25.0.1 or later and test that directory traversal attempts in templateFileDestination parameter are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file creation events in webroot directory
- Multiple failed directory traversal attempts in web server logs
- Asset Component creation by unexpected users
Network Indicators:
- HTTP requests with directory traversal patterns in templateFileDestination parameter
- Unexpected PHP file uploads to non-standard locations
SIEM Query:
source="web_logs" AND (templateFileDestination CONTAINS "../" OR templateFileDestination CONTAINS "..\")