CVE-2023-47799
📋 TL;DR
Mahara's experimental HTML bulk export feature fails to clear cached images between user exports, allowing users who receive exported files to potentially access other users' images. This affects Mahara installations using the experimental bulk export feature via admin interface or CLI.
💻 Affected Systems
- Mahara
📦 What is this software?
Mahara by Mahara
Mahara by Mahara
⚠️ Risk & Real-World Impact
Worst Case
Sensitive user images (potentially containing personal information) are disclosed to unauthorized users through exported files.
Likely Case
Accidental exposure of non-sensitive user images to other users who receive bulk export files.
If Mitigated
No impact if experimental bulk export feature is disabled or unused.
🎯 Exploit Status
Exploitation requires admin access to use bulk export feature or CLI access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 22.10.4 or 23.04.4
Vendor Advisory: https://mahara.org/interaction/forum/topic.php?id=9353
Restart Required: No
Instructions:
1. Backup your Mahara installation and database. 2. Upgrade to Mahara 22.10.4 (for 22.x branch) or 23.04.4 (for 23.x branch). 3. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Disable experimental bulk export
allDisable the experimental HTML bulk export feature in Mahara configuration
Edit Mahara config.php and set $cfg->enablebulkexport = false;
🧯 If You Can't Patch
- Disable experimental HTML bulk export feature immediately
- Restrict admin and CLI access to trusted personnel only
🔍 How to Verify
Check if Vulnerable:
Check Mahara version and verify if experimental bulk export is enabled in configurationCheck Version:
Check Mahara admin interface or config.php for version informationVerify Fix Applied:
Confirm version is 22.10.4 or higher (22.x branch) or 23.04.4 or higher (23.x branch)📡 Detection & Monitoring
Log Indicators:
- Bulk export operations in Mahara logs
- Multiple user exports in short timeframes
Network Indicators:
- Large file downloads from Mahara export endpoints
SIEM Query:
Search for 'bulk export' or 'export' events in Mahara application logs