Arbitrary File Read in ILIAS via SOAP addFile Method

Executive Summary

This is an arbitrary file read vulnerability in ILIAS versions before 9.22, 10.0 through 10.9, and 11.0 through 11.2. It exists in the SOAP addFile method where authenticated users can read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import directory to retrieve sensitive files like configuration files containing database credentials and setup passwords.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your ILIAS instance is running a vulnerable version (before 9.22, 10.0-10.9, or 11.0-11.2). Review SOAP service logs for unusual file read requests or XML parsing errors. Inspect network traffic for unauthorized file access attempts via SOAP addFile method.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with authenticated access to read arbitrary files on the server. This could lead to exposure of sensitive data such as configuration files, database credentials, and setup passwords. It may also enable further attacks by providing internal system information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (protected health information). Exposure of credentials or configuration files may result in data breaches, triggering regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update ILIAS to a patched version (9.22, 10.10, or 11.3+). Disable or restrict SOAP file import functionality if not required. Review and remove unnecessary file permissions for authenticated users. Monitor for suspicious file access patterns in logs.

Useful 0 Not Useful 0