CVE-2023-34960: Chamilo Command Injection Vulnerability

CVE-2023-34960 Overview

CVE-2023-34960 is a command injection vulnerability in the wsConvertPpt component of Chamilo, a popular open-source e-learning and content management platform. This flaw allows unauthenticated attackers to execute arbitrary system commands by sending a specially crafted SOAP API request with a malicious PowerPoint filename. The vulnerability affects Chamilo versions 1.11.* through 1.11.18.

Critical Impact

This vulnerability enables remote code execution without authentication, allowing attackers to completely compromise Chamilo installations, steal sensitive educational data, deploy malware, or pivot to other systems on the network.

Affected Products

• Chamilo v1.11.* through v1.11.18
• Chamilo LMS installations with SOAP API enabled
• Systems running the vulnerable wsConvertPpt component

Discovery Timeline

• 2023-04-20 - Vulnerability reported to Chamilo (Issue #112)
• 2023-08-01 - CVE-2023-34960 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-34960

Vulnerability Analysis

The vulnerability exists in the wsConvertPpt SOAP web service component, which is designed to convert PowerPoint presentations within the Chamilo learning management system. The component fails to properly sanitize user-supplied input when processing the filename parameter of uploaded PowerPoint files. When a malicious filename containing shell metacharacters is submitted via the SOAP API, these characters are passed directly to system shell commands without proper escaping or validation.

This is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), commonly known as Command Injection. The vulnerability is particularly dangerous because the SOAP API endpoint may be accessible without authentication, allowing any network-adjacent or internet-facing attacker to exploit it.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization in the wsConvertPpt function. When the component receives a PowerPoint filename through the SOAP API, it constructs shell commands to process the file conversion. The filename is concatenated directly into these commands without proper escaping of shell metacharacters such as semicolons (;), pipes (|), backticks (`), or dollar signs ($). This allows an attacker to inject additional commands that will be executed with the privileges of the web server user.

Attack Vector

The attack is carried out over the network by sending a malicious SOAP API request to the Chamilo server. The attacker crafts a request to the wsConvertPpt endpoint with a PowerPoint filename containing embedded shell commands. For example, a filename like presentation.ppt; whoami; # would cause the system to execute the whoami command after processing the file.

The vulnerability requires no prior authentication or user interaction, making it highly exploitable. An attacker simply needs network access to the Chamilo SOAP API endpoint. The exploitation technique involves sending a crafted SOAP envelope with the malicious filename to the web service endpoint, typically located at a path such as /main/webservices/additional_webservices.php.

For detailed technical information on exploitation, see the Packet Storm Security advisory.

Detection Methods for CVE-2023-34960

Indicators of Compromise

• Unusual HTTP POST requests to SOAP API endpoints such as /main/webservices/additional_webservices.php
• Web server logs containing suspicious PowerPoint filenames with shell metacharacters (;, |, $(, `)
• Unexpected processes spawned by the web server user (e.g., www-data, apache, nginx)
• Network connections initiated from the web server to external hosts
• New files created in web-accessible directories or temporary folders

Detection Strategies

• Monitor web server access logs for requests to SOAP API endpoints with unusual or encoded characters in parameters
• Implement Web Application Firewall (WAF) rules to detect command injection patterns in HTTP request bodies
• Deploy intrusion detection systems (IDS) with signatures for command injection attempts targeting Chamilo
• Use endpoint detection and response (EDR) solutions to identify suspicious process execution chains originating from web server processes

Monitoring Recommendations

• Enable detailed logging for the Chamilo application and SOAP API endpoints
• Configure alerts for any processes spawned by the web server that execute shell interpreters (/bin/sh, /bin/bash, cmd.exe)
• Monitor outbound network connections from web server hosts for potential data exfiltration or command-and-control communication
• Review file system changes in Chamilo installation directories and common web shell locations

How to Mitigate CVE-2023-34960

Immediate Actions Required

• Upgrade Chamilo to version 1.11.20 or later immediately
• If immediate upgrade is not possible, disable or restrict access to the SOAP API endpoints
• Implement network-level access controls to limit exposure of Chamilo to trusted networks only
• Review system logs for evidence of prior exploitation attempts
• If compromise is suspected, isolate the system and perform incident response procedures

Patch Information

Chamilo has addressed this vulnerability in versions after 1.11.18. Administrators should upgrade to Chamilo version 1.11.20 or the latest available release. The official security advisory and patch information can be found at the Chamilo Security Issues page.

Workarounds

• Disable the SOAP web services functionality if not required for operations by modifying the Chamilo configuration
• Use a reverse proxy or WAF to block requests containing shell metacharacters in SOAP API parameters
• Restrict network access to the /main/webservices/ directory using firewall rules or web server configuration
• Apply the principle of least privilege by running Chamilo under a restricted user account with minimal system permissions

# Example: Restrict access to SOAP API endpoints in Apache
<Directory "/var/www/chamilo/main/webservices">
    # Deny access from all IPs except trusted management network
    Require ip 10.0.0.0/8 192.168.1.0/24
    # Alternative: Deny all access if SOAP API is not needed
    # Require all denied
</Directory>