CVE-2024-50337: Chamilo LMS SSRF Vulnerability

CVE-2024-50337 Overview

CVE-2024-50337 is a Server-Side Request Forgery (SSRF) vulnerability affecting Chamilo, a popular open-source learning management system (LMS). The vulnerability exists in the OpenId function, which allows unauthenticated attackers to send arbitrary HTTP requests to any URL on behalf of the server. This blind SSRF vulnerability can be exploited to scan internal networks, access internal services, or potentially pivot to other attacks against infrastructure components that are not directly accessible from the internet.

Critical Impact

Unauthenticated attackers can abuse the Chamilo server to make requests to internal network resources, potentially exposing sensitive internal services and enabling further reconnaissance or attacks against protected infrastructure.

Affected Products

• Chamilo LMS versions prior to 1.11.28
• All installations using the OpenId authentication functionality
• Self-hosted and on-premises Chamilo deployments

Discovery Timeline

• 2026-03-02 - CVE CVE-2024-50337 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2024-50337

Vulnerability Analysis

The vulnerability resides in Chamilo's OpenId authentication implementation. The OpenId function fails to properly validate or restrict the target URLs that can be requested during the authentication flow. This allows an unauthenticated user to manipulate the OpenId discovery process to force the server to make HTTP requests to arbitrary URLs.

As a blind SSRF vulnerability (CWE-918), the attacker does not receive the response content directly but can still leverage this for various malicious purposes. The network-based attack vector requires no authentication and no user interaction, making it easily exploitable by remote attackers.

Root Cause

The root cause of this vulnerability is improper input validation in the OpenId function. The code accepts user-controlled URL parameters without adequately validating or restricting the destination. This lack of URL validation allows attackers to specify arbitrary internal or external URLs, which the server will then request on their behalf.

Specifically, the OpenId discovery mechanism trusts user-supplied URLs without implementing proper allowlisting, blocklisting of internal IP ranges, or URL scheme restrictions that would prevent SSRF attacks.

Attack Vector

The attack can be performed remotely over the network without any authentication requirements. An attacker can craft malicious requests to the OpenId endpoint, supplying URLs pointing to internal network resources such as:

• Internal web services on localhost or 127.0.0.1
• Cloud metadata endpoints (e.g., 169.254.169.254)
• Internal network hosts accessible from the Chamilo server
• Administrative interfaces on non-standard ports

The blind nature of this SSRF means attackers may use timing-based techniques or out-of-band channels to infer information about the internal network topology.

Detection Methods for CVE-2024-50337

Indicators of Compromise

• Unusual outbound HTTP requests from the Chamilo server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints (e.g., http://169.254.169.254/)
• High volume of requests to the OpenId authentication endpoints from external sources
• Server-side requests to uncommon ports or non-standard services

Detection Strategies

• Monitor web application logs for suspicious URL parameters in OpenId-related requests
• Implement network monitoring to detect outbound connections from the Chamilo server to unexpected internal destinations
• Deploy web application firewalls (WAF) with SSRF detection rules to inspect and block malicious requests
• Review authentication logs for anomalous OpenId discovery attempts

Monitoring Recommendations

• Enable verbose logging on the Chamilo application server to capture all authentication-related requests
• Configure network segmentation alerts to detect when the web server attempts to reach internal-only services
• Set up egress filtering alerts for connections to private IP ranges or cloud metadata services
• Monitor for patterns consistent with SSRF exploitation, such as sequential IP scanning or port probing

How to Mitigate CVE-2024-50337

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.28 or later immediately
• If immediate patching is not possible, consider temporarily disabling the OpenId authentication functionality
• Implement network-level controls to restrict outbound requests from the Chamilo server
• Review server logs for evidence of prior exploitation attempts

Patch Information

Chamilo has addressed this vulnerability in version 1.11.28. The fix is available in commit 43a9bd1fb8b3f57e7935a6a6bc48975e2063b01b. Organizations should upgrade to the patched version as soon as possible. Additional details can be found in the GitHub Security Advisory GHSA-rp2w-g734-jf8h and the official release notes for v1.11.28.

Workarounds

• Disable OpenId authentication functionality if not required for your deployment
• Implement network egress filtering to block requests to internal IP ranges and cloud metadata endpoints from the Chamilo server
• Deploy a web application firewall with SSRF protection rules in front of the Chamilo installation
• Use network segmentation to isolate the Chamilo server from sensitive internal resources

# Example iptables rules to block common SSRF targets from the web server
# Block requests to internal networks
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner www-data -j DROP
# Block cloud metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner www-data -j DROP