CVE-2023-4220: Chamilo LMS RCE Vulnerability

CVE-2023-4220 Overview

CVE-2023-4220 is an unrestricted file upload vulnerability in the big file upload functionality of Chamilo LMS versions 1.11.24 and earlier. The vulnerability exists in /main/inc/lib/javascript/bigupload/inc/bigUpload.php and allows unauthenticated attackers to upload arbitrary files, including web shells. This can lead to stored cross-site scripting (XSS) attacks and remote code execution (RCE) on affected systems.

Critical Impact

Unauthenticated attackers can achieve remote code execution by uploading malicious web shells through the unrestricted file upload functionality, potentially compromising the entire Chamilo LMS installation and underlying server infrastructure.

Affected Products

• Chamilo LMS versions <= 1.11.24
• All installations using the BigUpload functionality at /main/inc/lib/javascript/bigupload/inc/bigUpload.php
• Self-hosted Chamilo LMS deployments with default configurations

Discovery Timeline

• 2023-09-04 - Vulnerability reported as Issue #130 in Chamilo security issues tracker
• 2023-11-28 - CVE-2023-4220 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-4220

Vulnerability Analysis

This vulnerability stems from inadequate file upload validation in Chamilo LMS's BigUpload component. The affected endpoint at /main/inc/lib/javascript/bigupload/inc/bigUpload.php fails to properly restrict the types of files that can be uploaded, allowing attackers to submit executable PHP files without authentication.

The BigUpload functionality was designed to handle large file uploads but included an insecure method that exposed a direct path to the server's file system. The component defined a temporary upload directory (/tmp/) and a main files directory (../files/) without proper file type validation or access controls. This architectural flaw allows attackers to upload malicious PHP web shells that, once accessed via a web browser, execute arbitrary commands on the server.

The attack chain combines unrestricted file upload (CWE-434) with stored cross-site scripting (CWE-79) capabilities, creating multiple exploitation paths for attackers.

Root Cause

The root cause of this vulnerability is the absence of file type validation and authentication requirements in the BigUpload PHP class. The vulnerable code allowed direct file uploads to a web-accessible directory without verifying:

1. Whether the requester was an authenticated user
2. Whether the uploaded file type was within an allowed whitelist
3. Whether the file contents matched its declared type

The BigUploadResponse class defined static paths for file storage that were directly accessible via the web server, enabling immediate execution of uploaded malicious scripts.

Attack Vector

The attack is network-based and requires no authentication or user interaction to exploit the file upload functionality. An attacker can craft a malicious HTTP POST request to the vulnerable endpoint, uploading a PHP web shell. Once uploaded, the attacker navigates to the uploaded file's location in the ../files/ directory to trigger execution.

The exploitation flow involves:

1. Sending an unauthenticated POST request with a malicious PHP file to the BigUpload endpoint
2. The server stores the file without validation in a web-accessible directory
3. Attacker accesses the uploaded file via direct URL to execute arbitrary PHP code
4. Full server compromise through the web shell's command execution capabilities

 
 class BigUploadResponse
 {
-    /**
-     * Temporary directory for uploading files.
-     */
-    const TEMP_DIRECTORY = '/tmp/';
-
-    /**
-     * Directory files will be moved to after the upload is completed.
-     */
-    const MAIN_DIRECTORY = '../files/';
-
     /**
      * Max allowed filesize. This is for unsupported browsers and
      * as an additional security check in case someone bypasses the js filesize check.

Source: GitHub Commit Reference

The security patch removes the unused upload method entirely, eliminating the vulnerable functionality from the codebase.

Detection Methods for CVE-2023-4220

Indicators of Compromise

• Unexpected PHP files appearing in the /main/inc/lib/javascript/bigupload/files/ directory
• Web server logs showing POST requests to /main/inc/lib/javascript/bigupload/inc/bigUpload.php from unauthenticated sessions
• Suspicious file extensions or obfuscated filenames in the BigUpload temporary or files directories
• Evidence of web shell activity such as command execution or reverse shell connections originating from the web server

Detection Strategies

• Monitor HTTP POST requests to the BigUpload endpoint (/main/inc/lib/javascript/bigupload/inc/bigUpload.php) for suspicious payloads
• Implement file integrity monitoring on the Chamilo LMS installation directory to detect unauthorized file additions
• Deploy web application firewall (WAF) rules to block file uploads containing PHP code or web shell signatures
• Analyze web server access logs for patterns indicative of web shell access (e.g., repeated requests with command parameters)

Monitoring Recommendations

• Enable verbose logging for the Chamilo LMS application and underlying web server
• Configure alerts for new file creation events in web-accessible directories
• Implement network monitoring to detect outbound connections from the web server that may indicate reverse shell activity
• Regularly audit the BigUpload files directory for unauthorized content

How to Mitigate CVE-2023-4220

Immediate Actions Required

• Upgrade Chamilo LMS to a version newer than 1.11.24 that includes the security patch
• If immediate upgrade is not possible, remove or restrict access to the vulnerable BigUpload component
• Review the BigUpload files directory for any suspicious uploads and remove unauthorized files
• Audit web server logs for evidence of prior exploitation attempts

Patch Information

Chamilo has addressed this vulnerability by removing the unused file upload method from the BigUpload component. The fix is available in commit 3b487a55076fb06f96809b790a35dcdd42f8ec49. Organizations should update to the latest Chamilo LMS version that includes this security patch. Refer to the Chamilo Security Issue Report and the GitHub Commit Reference for detailed patch information.

Workarounds

• Block access to the BigUpload directory at the web server level using .htaccess or equivalent configuration
• Implement network-level access controls to restrict access to the Chamilo LMS administrative endpoints
• Deploy a web application firewall (WAF) with rules to block malicious file uploads
• Remove the bigupload directory entirely if the large file upload functionality is not required

# Apache configuration to block access to BigUpload directory
<Directory "/path/to/chamilo/main/inc/lib/javascript/bigupload">
    Require all denied
</Directory>

# Nginx configuration to block access to BigUpload directory
location /main/inc/lib/javascript/bigupload {
    deny all;
    return 403;
}