CVE-2023-4226: 
Chamilo vulnerability analysis and mitigation

CVE-2023-4226 affects Chamilo LMS versions up to and including v1.11.24. The vulnerability involves an unrestricted file upload functionality in /main/inc/ajax/work.ajax.php that allows authenticated attackers with learner role to obtain remote code execution through PHP file uploads. This vulnerability was discovered and reported by Ngo Wei Lin of STAR Labs SG Pte. Ltd., with initial disclosure on September 4, 2023 (STAR Labs).

The vulnerability exists in the file upload chunking implementation within /main/inc/ajax/work.ajax.php. The code does not impose restrictions on uploaded files, which are written to SYS_ARCHIVE_PATH (defaulting to //app/cache). Although a .htaccess file exists in //app/cache, it can be overwritten to allow execution of PHP files. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (STAR Labs, NVD).

Successful exploitation of this vulnerability allows authenticated attackers with learner role to achieve remote code execution on the target system. Additionally, attackers can perform stored cross-site scripting attacks through the upload of malicious files. The vulnerability provides attackers with high levels of impact on system confidentiality, integrity, and availability (STAR Labs).

The vulnerability was patched in Chamilo version 1.11.26, released on September 27, 2023. The fix includes sanitizing user-supplied filenames to prevent uploading files with dangerous extensions, particularly PHP files. Additional security measures include adding rules to the .htaccess file to disallow direct access to upload directories and prevent MIME sniffing. Users are strongly encouraged to upgrade to the latest version of Chamilo (STAR Labs).

The disclosure of this vulnerability was coordinated with the vendor, and a mutual agreement was reached to delay the publication of vulnerability details due to recent in-the-wild exploitation of another Chamilo vulnerability (CVE-2023-34960). This demonstrates the security community's responsible approach to vulnerability disclosure and vendor cooperation (STAR Labs).