AI analysis
ILIAS, an open-source learning management system, is vulnerable to an unauthenticated PHP object injection flaw (CWE-502) exploitable through the combination of its LTI authentication and Shibboleth back-channel logout endpoints. An unauthenticated attacker first injects arbitrary serialized objects into session storage via the LTI authentication endpoint, then triggers unsafe deserialization of that data through the Shibboleth back-channel logout endpoint. By chaining an available POP (property-oriented programming) gadget, the attacker can write attacker-controlled PHP content to a web-accessible path, achieving remote code execution with the privileges of the web server user. All ILIAS deployments on affected versions — prior to 9.22 on the 9.x branch, prior to 10.10 on the 10.x branch, and prior to 11.3 on the 11.x branch — are affected, with exploitation requiring no credentials or user interaction (CVSS 4.0: 9.3). As of now there is no known public proof-of-concept, it is not listed in CISA KEV, and EPSS estimates only a 0.7% chance of exploitation within 30 days, so no in-the-wild exploitation is confirmed.
What to do: Upgrade ILIAS to 9.22, 10.10, or 11.3 or later, depending on your branch. Where patching is delayed, restrict network or web-server access to the LTI authentication and Shibboleth back-channel logout endpoints, and audit session storage and web-accessible directories for unexpected PHP files that would indicate prior exploitation.
Affected
| ILIAS | 9.x before 9.22 |
| ILIAS | 10.0 to before 10.10 |
| ILIAS | 11.0 to before 11.3 |
Estimated exposure
largeplausibly thousands of institutional LMS deployments serving hundreds of thousands of users (estimate, not a measured count) — ILIAS is an open-source LMS typically deployed one instance per university or educational institution, concentrated in German-speaking Europe, so the affected base is likely on the order of thousands of installations whose combined…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.