CVE-2023-3533: Chamilo LMS Path Traversal Vulnerability

CVE-2023-3533 Overview

CVE-2023-3533 is a path traversal vulnerability in the file upload functionality of Chamilo LMS, an open-source learning management system. The flaw resides in /main/webservices/additional_webservices.php and affects all versions up to and including v1.11.20. Unauthenticated attackers can write arbitrary files to the server filesystem by manipulating filename parameters with directory traversal sequences. Successful exploitation leads to stored cross-site scripting (XSS) and remote code execution (RCE). The weakness is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated attackers can achieve remote code execution on Chamilo LMS instances by writing arbitrary files through the webservices endpoint, resulting in full server compromise.

Affected Products

Chamilo LMS versions ≤ 1.11.20
/main/webservices/additional_webservices.php endpoint
Installations exposing webservices to the network

Discovery Timeline

2023-11-28 - CVE-2023-3533 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-3533

Vulnerability Analysis

The vulnerability exists in the SOAP webservice handler that processes PowerPoint to learning path conversion requests. The function accepts a file_name parameter from the request and uses it to construct filesystem paths for temporary archive storage. The original code passed this value through Security::sanitizeExecParam(), which only stripped shell metacharacters such as backticks, semicolons, ampersands, and pipes. This filter did not block ../ traversal sequences, allowing attackers to escape the intended working directory.

Attackers submit a crafted SOAP request containing file data and a filename with traversal sequences. The server writes the attacker-controlled content to arbitrary locations within the web root. Writing a PHP file into a web-accessible directory yields direct remote code execution under the web server user context.

Root Cause

The sanitizeExecParam function was designed to neutralize shell injection but was reused as a generic filename sanitizer. It performed no validation against .. sequences or absolute paths. The downstream Security::filter_filename only removed .php and .htaccess references from the filename, not from the full path structure used to build $tempPath.

Attack Vector

The attack requires no authentication and is exploitable over the network through the public webservices endpoint. An attacker sends a SOAP request to additional_webservices.php invoking the PPT-to-LP conversion service with a malicious file_name value such as ../../../../var/www/html/shell.php and arbitrary file_data content.

php

// Patch in main/webservices/additional_webservices.php
// Source: https://github.com/chamilo/chamilo-lms/commit/37be9ce7243a30259047dd4517c48ff8b21d657a
    $fileData = $pptData['file_data'];
    // Clean filename to avoid hacks. Prevents "&" and ";" to be used in filename, notably
-    $sanitizedFileName = Security::sanitizeExecParam($pptData['file_name']);
+
+    if (strpos($pptData['file_name'], '..') !== false) {
+        return false;
+    }
+
+    $sanitizedFileName = $pptData['file_name'];
    $dataInfo = pathinfo($sanitizedFileName);
    $fileName = basename($sanitizedFileName, '.'.$dataInfo['extension']);
    // Add additional cleaning of .php and .htaccess files
    $fullFileName = Security::filter_filename($sanitizedFileName);
-    $size = Security::sanitizeExecParam($pptData['service_ppt2lp_size']);
+    $size = $pptData['service_ppt2lp_size'];

The fix rejects any filename containing .. outright and casts the width and height parameters to integers, eliminating both path traversal and shell injection through dimension values.

Detection Methods for CVE-2023-3533

Indicators of Compromise

POST requests to /main/webservices/additional_webservices.php from external sources
SOAP request bodies containing .. sequences in the file_name element
New or modified .php, .phtml, or .htaccess files in Chamilo directories not associated with updates
Web shell artifacts under main/, app/, or web/ paths owned by the web server user

Detection Strategies

Inspect web server access logs for unauthenticated requests to additional_webservices.php containing encoded traversal patterns such as %2e%2e%2f
Hunt for outbound network connections initiated by PHP-FPM or Apache worker processes that deviate from baseline
Apply file integrity monitoring to the Chamilo document root to flag unexpected PHP file creation

Monitoring Recommendations

Alert on SOAP envelopes referencing wsConvertPpt operations from untrusted source addresses
Track child processes spawned by the web server, especially shell interpreters and ppt2png executions with unusual arguments
Correlate file creation events in archive directories with subsequent HTTP requests targeting those new files

How to Mitigate CVE-2023-3533

Immediate Actions Required

Upgrade Chamilo LMS to a version that includes commit 37be9ce or later
Restrict network access to /main/webservices/ to trusted integration partners only
Audit the Chamilo document root for unauthorized PHP files and remove any web shells
Rotate credentials and API tokens stored within the Chamilo configuration if compromise is suspected

Patch Information

The upstream fix is published in the Chamilo LMS GitHub commit 37be9ce. Additional vendor details appear in the Chamilo Security Issue #124 advisory and the StarLabs Security Advisory #23-3533.

Workarounds

Disable the webservices module entirely if it is not required for production workflows
Block access to additional_webservices.php at the reverse proxy or web application firewall layer
Enforce IP allowlisting on the webservices endpoint to limit exposure to known consumers

bash

# Apache configuration to block external access to the vulnerable endpoint
<Location "/main/webservices/additional_webservices.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>