CVE-2024-50337
📋 TL;DR
Chamilo LMS versions before 1.11.28 contain an unauthenticated blind Server-Side Request Forgery (SSRF) vulnerability in the OpenId function. This allows attackers to make arbitrary HTTP requests from the vulnerable server to internal or external systems. Any Chamilo installation with the vulnerable OpenId functionality enabled is affected.
💻 Affected Systems
- Chamilo LMS
📦 What is this software?
Chamilo Lms by Chamilo
⚠️ Risk & Real-World Impact
Worst Case
Attackers could scan internal networks, access internal services, exploit chained vulnerabilities, or use the server as a proxy for attacks against other systems.
Likely Case
Internal network reconnaissance, data exfiltration from internal services, or denial of service through request loops.
If Mitigated
Limited impact if network segmentation restricts server outbound connections and internal services require authentication.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited with simple HTTP request manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.28
Vendor Advisory: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rp2w-g734-jf8h
Restart Required: No
Instructions:
1. Backup your Chamilo installation and database. 2. Download version 1.11.28 from the official repository. 3. Replace vulnerable files with patched versions. 4. Clear application cache if applicable.
🔧 Temporary Workarounds
Disable OpenId functionality
allTemporarily disable or restrict access to the vulnerable OpenId endpoint.
# Modify Chamilo configuration to disable OpenId or restrict access via .htaccess/web.config
Network egress filtering
allRestrict outbound HTTP/HTTPS connections from the Chamilo server to only necessary destinations.
# Configure firewall rules to limit outbound connections from Chamilo server IP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Chamilo server from internal systems
- Deploy web application firewall (WAF) rules to detect and block SSRF patterns
🔍 How to Verify
Check if Vulnerable:
Check if Chamilo version is below 1.11.28 and OpenId functionality is accessible.Check Version:
Check Chamilo configuration file or admin panel for version information.Verify Fix Applied:
Confirm installation of version 1.11.28 and test OpenId endpoint for SSRF behavior.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Chamilo server
- Requests to internal IP addresses or unusual domains from OpenId endpoint
Network Indicators:
- HTTP traffic from Chamilo server to unexpected internal/external destinations
SIEM Query:
source_ip="chamilo_server" AND (dest_ip="internal_range" OR dest_port=80 OR dest_port=443) AND NOT dest_ip="allowed_destinations"