CVE-2025-11281
📋 TL;DR
This vulnerability in Frappe LMS 2.35.0 allows attackers to bypass access controls on unpublished courses through the /courses/ endpoint. Attackers can potentially access restricted course content without proper authorization. The vulnerability affects all systems running the vulnerable version of Frappe LMS.
💻 Affected Systems
- Frappe LMS
📦 What is this software?
Learning by Frappe
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to unpublished course materials, potentially including sensitive educational content, intellectual property, or private student data.
Likely Case
Unauthorized viewing of unpublished course content that should only be accessible to instructors or administrators.
If Mitigated
No impact if proper access controls are implemented or the vulnerability is patched.
🎯 Exploit Status
Exploit details are publicly available but require specific knowledge of the system and attack complexity is high.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 2.35.0
Vendor Advisory: Not specified in provided references
Restart Required: Yes
Instructions:
1. Upgrade Frappe LMS to the latest version. 2. Verify the fix by checking that unpublished courses are no longer accessible via the vulnerable endpoint.
🔧 Temporary Workarounds
Restrict access to /courses/ endpoint
allImplement network-level or application-level access controls to restrict unauthorized access to the /courses/ endpoint.
Disable unpublished course functionality
allTemporarily disable the unpublished course handler component until patching can be completed.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the Frappe LMS instance from untrusted networks.
- Deploy a web application firewall (WAF) with rules to detect and block unauthorized access attempts to the /courses/ endpoint.
🔍 How to Verify
Check if Vulnerable:
Check if running Frappe LMS version 2.35.0 and test if unpublished courses are accessible via the /courses/ endpoint without proper authorization.Check Version:
Check Frappe LMS version in application settings or via the admin interface.Verify Fix Applied:
After upgrading, verify that unpublished courses are no longer accessible without proper authentication and authorization.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /courses/ endpoint
- Multiple failed authentication attempts followed by successful access to unpublished courses
Network Indicators:
- Unusual traffic patterns to /courses/ endpoint from unauthorized IP addresses
SIEM Query:
source="frappe_lms" AND (url_path="/courses/" AND (user="anonymous" OR auth_status="failed"))🔗 References
- https://gist.github.com/0xHamy/5ebd820ad30f33827011e9a614fb2f89
- https://gist.github.com/0xHamy/5ebd820ad30f33827011e9a614fb2f89#steps-to-reproduce
- https://vuldb.com/?ctiid.327015
- https://vuldb.com/?id.327015
- https://vuldb.com/?submit.659695
- https://gist.github.com/0xHamy/5ebd820ad30f33827011e9a614fb2f89
- https://gist.github.com/0xHamy/5ebd820ad30f33827011e9a614fb2f89#steps-to-reproduce
- https://vuldb.com/?submit.659695
