CVE-2025-11345: Ilias Ilias RCE Vulnerability

CVE-2025-11345 Overview

A critical insecure deserialization vulnerability has been identified in ILIAS, a widely-used open-source learning management system (LMS). The flaw exists in the Test Import component, specifically within the unserialize function, allowing attackers to manipulate serialized data and potentially achieve remote code execution. This vulnerability affects ILIAS versions up to 8.23, 9.13, and 10.1, putting educational institutions and organizations using this platform at risk.

Critical Impact

Attackers with authenticated access can remotely exploit the insecure deserialization flaw in ILIAS Test Import functionality to execute arbitrary code, compromise data integrity, and potentially gain persistent access to the learning management system.

Affected Products

• ILIAS versions up to 8.23
• ILIAS versions up to 9.13
• ILIAS versions up to 10.1

Discovery Timeline

• 2025-10-06 - CVE-2025-11345 published to NVD
• 2026-01-23 - Last updated in NVD database

Technical Details for CVE-2025-11345

Vulnerability Analysis

This insecure deserialization vulnerability (CWE-502) affects the Test Import component of ILIAS. The vulnerable unserialize function processes user-supplied serialized data without adequate validation, enabling object injection attacks. When combined with improper input validation (CWE-20), an authenticated attacker can craft malicious serialized payloads that, when deserialized by the application, trigger arbitrary code execution through PHP's magic methods or existing gadget chains within the application codebase.

The vulnerability requires network access and user interaction, with the attacker needing low-level privileges (authenticated access) to exploit the flaw. While the impact is limited in terms of confidentiality, integrity, and availability individually, the combination creates a significant security risk for affected ILIAS installations.

Root Cause

The root cause lies in the improper handling of serialized data within the Test Import functionality. The application directly passes user-controlled input to PHP's unserialize() function without proper sanitization or type checking. This allows attackers to inject crafted serialized objects that exploit PHP Object Injection (POI) vulnerabilities, potentially leading to arbitrary code execution when suitable gadget chains are present in the application or its dependencies.

Attack Vector

The attack is network-based and can be initiated remotely by an authenticated user with access to the Test Import functionality. The attacker crafts a malicious serialized PHP object payload designed to exploit magic methods such as __wakeup(), __destruct(), or __toString() during the deserialization process. When the vulnerable component processes this payload through the unserialize function, the malicious object is instantiated, triggering the attack chain.

The exploitation path involves identifying available PHP classes within ILIAS that can be chained together to achieve code execution. For detailed technical analysis of this vulnerability class in ILIAS, refer to the SRLabs Analysis on Ilias RCE.

Detection Methods for CVE-2025-11345

Indicators of Compromise

• Unusual or malformed data submissions to the Test Import functionality, particularly containing serialized PHP objects
• Web server logs showing POST requests with encoded serialized data payloads targeting test import endpoints
• Unexpected PHP errors or warnings related to object instantiation or magic method execution
• Signs of unauthorized file creation, modification, or system command execution originating from web server processes

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in HTTP requests
• Monitor application logs for deserialization errors, object injection attempts, or unusual class instantiation events
• Deploy file integrity monitoring on the ILIAS installation directory to detect unauthorized modifications
• Review authentication logs for suspicious access patterns to the Test Import feature

Monitoring Recommendations

• Enable verbose logging for the Test Import component and monitor for anomalous activity
• Implement network traffic analysis to identify potentially malicious serialized payloads
• Configure alerts for any unexpected outbound connections from the ILIAS server
• Regularly audit user access to administrative functions including Test Import capabilities

How to Mitigate CVE-2025-11345

Immediate Actions Required

• Upgrade ILIAS to patched versions: 8.24, 9.14, or 10.2 respectively based on your current major version
• Temporarily restrict access to the Test Import functionality until patching is complete
• Review access controls and limit Test Import permissions to trusted administrators only
• Implement additional input validation at the network perimeter using WAF rules

Patch Information

ILIAS has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

For official patch information and upgrade instructions, refer to the ILIAS Security Advisory. Additional vulnerability details are available via VulDB.

Workarounds

• Disable or restrict access to the Test Import feature until patching can be completed
• Implement strict input validation at the application or network level to filter serialized object patterns
• Deploy PHP runtime protections that can detect and block deserialization of unauthorized classes
• Consider using network segmentation to limit exposure of the ILIAS server to untrusted networks

# Example: Restrict access to Test Import via .htaccess (temporary workaround)
# Add to ILIAS web root .htaccess file
<LocationMatch "/Modules/Test/.*import">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</LocationMatch>