CVE-2024-33526 - Stored Cross-site Scripting (XSS) Vulnerability in ILIAS 7 and 8 Affects User Role Import Feature

A newly discovered vulnerability, identified as CVE-2024-33526, has been found in ILIAS 7 and 8, an open-source Learning Management System (LMS). The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, which can be exploited by remote attackers possessing administrative privileges within the platform. The flaw specifically affects the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11. If exploited, the vulnerability can allow the injection of arbitrary web scripts or HTML content via an XML file upload.

Exploit Details

In order to exploit this vulnerability, an attacker with administrative privileges needs to import user roles and role titles through an XML file. This file can contain malicious web scripts or HTML content, which gets persisted within the ILIAS platform. When other users interact with the affected content or sections, the malicious script will execute within their browser. As a result, sensitive user data may be compromised, or the attacker could gain unauthorized access to the platform by potentially hijacking user sessions or escalating privileges.

A sample XML file containing the malicious script could look like the following

<?xml version="1." encoding="UTF-8"?>
<role xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; title="<script>alert('XSS');</script>">
    <RoleDescription>Administrator</RoleDescription>
    <RolePermissions>
        <Permission context="Read">grant</Permission>
        <Permission context="Write">grant</Permission>
        <!-- ... -->
    </RolePermissions>
</role>

In this example, the "title" attribute of the "role" element contains a simple JavaScript alert that displays "XSS" when executed. An attacker could replace this with more sophisticated or harmful script.

Original References

1. ILIAS Security Advisory: https://ilias.de/goto.php?target=srsr_441&client_id=docu3
2. CVE Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33526

Recommendations

To address this vulnerability and protect your ILIAS LMS environment, it is highly recommended to apply the necessary updates to your platform. The following versions contain fixes for CVE-2024-33526:

ILIAS 8: upgrade to version 8.11 or later

Updating your ILIAS version will ensure the proper handling and filtering of imported XML files so that malicious content cannot be injected into the platform.

Conclusion

The discovery of the CVE-2024-33526 vulnerability highlights the need to maintain an up-to-date and secure environment when utilizing platforms like ILIAS. Ensuring all users follow the principle of least privilege can help mitigate the risk of malicious actors exploiting these types of vulnerabilities. Finally, regularly monitoring and auditing your platform will help identify any suspicious activities and allow you to take swift action to rectify any issues.

Timeline

Published on: 05/21/2024 15:15:28 UTC
Last modified on: 08/01/2024 13:52:03 UTC