CVE-2024-27524
📋 TL;DR
This is a Cross-Site Scripting (XSS) vulnerability in Chamilo LMS v1.11.26 that allows remote attackers to inject malicious scripts via the filename parameter in new_ticket.php. Successful exploitation could lead to privilege escalation by executing arbitrary JavaScript in the context of other users. All systems running the vulnerable version are affected.
💻 Affected Systems
- Chamilo LMS
📦 What is this software?
Chamilo Lms by Chamilo
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains administrative privileges, steals session cookies, performs actions as any user, and potentially compromises the entire LMS instance.
Likely Case
Attacker steals user session cookies, performs unauthorized actions as authenticated users, and potentially escalates privileges to gain administrative access.
If Mitigated
Script execution is blocked by Content Security Policy or input validation, limiting impact to minor UI disruption.
🎯 Exploit Status
Exploitation requires ability to interact with the ticket system. The GitHub commit shows the specific vulnerable code pattern.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit 53275c152275958b33a1f87a21843daa52fb543a
Vendor Advisory: https://github.com/chamilo/chamilo-lms/commit/53275c152275958b33a1f87a21843daa52fb543a
Restart Required: No
Instructions:
1. Update to latest Chamilo LMS version. 2. Apply the specific commit 53275c152275958b33a1f87a21843daa52fb543a. 3. Verify the fix by checking new_ticket.php for proper input sanitization.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize filename parameter inputs
Modify new_ticket.php to filter filename parameter using htmlspecialchars() or similar functions
WAF Rule
allImplement Web Application Firewall rules to block XSS payloads in filename parameter
Add WAF rule: Detect and block scripts in filename parameter of new_ticket.php requests
🧯 If You Can't Patch
- Disable or restrict access to the new_ticket.php component
- Implement strict Content Security Policy headers to prevent script execution
🔍 How to Verify
Check if Vulnerable:
Check if Chamilo LMS version is 1.11.26 and examine new_ticket.php for missing input sanitization on filename parameterCheck Version:
Check Chamilo version in main/inc/conf/configuration.php or via admin panelVerify Fix Applied:
Verify that filename parameter in new_ticket.php now uses proper output encoding (e.g., htmlspecialchars)📡 Detection & Monitoring
Log Indicators:
- Unusual filename parameters containing script tags in new_ticket.php requests
- Multiple failed ticket submissions with suspicious filenames
Network Indicators:
- HTTP requests to new_ticket.php with script payloads in filename parameter
SIEM Query:
source="web_logs" AND uri="/main/ticket/new_ticket.php" AND filename CONTAINS "<script>"