CVE-2023-34960: Command Injection Vulnerability in Chamilo's wsConvertPpt Component

Chamilo, a popular open-source Learning Management System (LMS), has been found to have a critical command injection vulnerability in its wsConvertPpt component. This vulnerability, identified as CVE-2023-34960, affects versions v1.11.* up to v1.11.18 and can potentially allow attackers to execute arbitrary commands on the target system.

A command injection vulnerability occurs when an application passes unsafe data to a system shell. In this case, an attacker can exploit the vulnerability through a specially crafted PowerPoint file name during a SOAP API call. The attacker is able to manipulate the input in a way that the application executes an arbitrary command with the privileges of the vulnerable application.

This long read post explores the details of this vulnerability, including the specific code snippets, attack scenarios, and possible mitigation steps. We would also provide links to original references for further understanding and analysis.

Code snippet

The vulnerability exists in the wsConvertPpt method of the wsConvertPpt component in Chamilo. The following code snippet demonstrates the affected part of the wsConvertPpt method:

function wsConvertPpt($username, $password, $ppt, $type)
{
    // ...
    $extension = getExtension($ppt);
    $ppt_name = basename($ppt, $extension);
    // ...
    $cmd = "soffice --headless --convert-to pdf --outdir +++" . $to . "+++ " . $ppt_name;
    $output = shell_exec($cmd);
	// ...
}

As seen in the code above, the user-controlled $ppt_name variable is directly passed into a shell_exec function without proper sanitization, allowing an attacker to potentially inject arbitrary commands.

Exploit details

To exploit this vulnerability, an attacker would have to create a PowerPoint file with a crafted file name containing the desired command(s). When this file is uploaded to the Chamilo server, the attacker would then have to make a SOAP API call with the crafted file name. Given the nature of SOAP APIs, the attack could be carried out using various tools or even a simple curl command, as demonstrated below:

curl --header "Content-Type: text/xml;charset=UTF-8" -d @payload.xml http://target.com/path/to/wsConvertPpt

Where the payload.xml file contains the SOAP API request data, including the crafted file name.

Original References

1. Chamilo LMS Homepage
2. Chamilo GitHub Repository
3. CVE-2023-34960 Details & Description
4. NIST National Vulnerability Database

Mitigation

To protect against exploitation of this vulnerability, it is recommended to upgrade to a patched version of Chamilo as soon as it becomes available. In the meantime, administrators can implement input validation techniques, such as regular expressions or allowlisting, to restrict the characters that can be accepted as input for the $ppt_name variable. This would help prevent attackers from injecting malicious commands into the application's execution flow.

Conclusion

The command injection vulnerability in Chamilo's wsConvertPpt component poses a significant risk to the security and stability of the LMS. It is crucial for system administrators to be vigilant and take proactive steps to mitigate the risks associated with such vulnerabilities. By understanding the exploit details, applying security patches, and implementing input validation techniques, administrators can better protect their systems and users from potential attacks.

Timeline

Published on: 08/01/2023 02:15:00 UTC
Last modified on: 08/24/2023 17:15:00 UTC