Compliance Impact

The vulnerability allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) to access internal network services and cloud metadata endpoints, potentially leading to the theft of IAM credentials and sensitive instance metadata.

Such unauthorized access to sensitive information could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive data.

Therefore, exploitation of this vulnerability may result in non-compliance with these standards due to unauthorized data exposure and insufficient access controls.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an unauthenticated SSRF in the PENS plugin endpoint at public/plugin/Pens/pens.php in Chamilo LMS versions prior to 2.0.0-RC.3. Detection can focus on identifying access attempts to this endpoint and monitoring for unusual outbound requests triggered by the package-url parameter.

You can detect attempts to exploit this vulnerability by checking web server logs for requests to the vulnerable endpoint, for example:

• grep 'public/plugin/Pens/pens.php' /var/log/apache2/access.log
• grep 'public/plugin/Pens/pens.php' /var/log/nginx/access.log

To detect SSRF activity, monitor outgoing HTTP requests from the server that include suspicious or internal IP addresses, such as 169.254.169.254 (cloud metadata endpoint). For example, using tcpdump or similar tools:

• tcpdump -i eth0 dst host 169.254.169.254 and tcp port 80
• tcpdump -i eth0 dst net 10.0.0.0/8 or dst net 192.168.0.0/16 or dst net 172.16.0.0/12

Additionally, you can use curl or similar tools to test if the endpoint is accessible without authentication:

• curl -v 'http://your-chamilo-server/public/plugin/Pens/pens.php?package-url=http://example.com'

If the server fetches the URL without authentication and allows internal IP addresses, it is vulnerable.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Chamilo LMS versions prior to 2.0.0-RC.3 in the PENS plugin endpoint located at public/plugin/Pens/pens.php. The endpoint is accessible without authentication and accepts a user-controlled package-url parameter. The server fetches the URL using curl without filtering out private or internal IP addresses, which enables an unauthenticated Server-Side Request Forgery (SSRF) attack.

An attacker can exploit this flaw to probe internal network services, access cloud metadata endpoints (such as 169.254.169.254) to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters.

No authentication is required to exploit these SSRF vectors, which significantly increases the attack surface.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized access to internal network services and sensitive cloud metadata.

• Attackers can probe internal network services that are normally inaccessible from outside.
• Attackers can access cloud metadata endpoints to steal IAM credentials and sensitive instance metadata, potentially leading to further compromise of cloud resources.
• Attackers can trigger state-changing operations on internal services using the receipt and alerts callback parameters, which could disrupt normal operations.

Since no authentication is required, the risk and attack surface are significantly increased.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Chamilo LMS to version 2.0.0-RC.3 or later, where the issue has been fixed.

Useful 0 Not Useful 0