CVE-2025-66447

Executive Summary

CVE-2025-66447 is an open redirect vulnerability in Chamilo LMS, a widely used open-source learning management system. The flaw exists in versions from 1.11.0 up to (but not including) 2.0-beta.2. An unauthenticated attacker can exploit the redirect parameter on the /login page to redirect users to an arbitrary external domain. This is a classic URL redirection to untrusted site (CWE-601) vulnerability.

While the CVSS score is low (0.0 in the NVD data, but realistically a CVSS 4.0 score of 5.4), the impact is significant for phishing and social engineering campaigns. An attacker can craft a link that appears to be a legitimate Chamilo login page but redirects the user to a malicious site after authentication, potentially stealing credentials or session tokens.

The vulnerability is patched in Chamilo LMS 2.0-beta.2. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

Chamilo LMS is a PHP-based application distributed as a ZIP archive or via Composer. The vulnerability is in the core application code, not in a third-party package. However, organizations using Chamilo should verify their deployment version and apply the patch immediately. The fix is included in the 2.0-beta.2 release, which can be obtained from the official Chamilo GitHub repository or the Chamilo website.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability requires user interaction but can be used in targeted phishing attacks. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but this may change as awareness increases.

Deep Dive & Mechanics

The vulnerability resides in the /login endpoint of Chamilo LMS. The application accepts a redirect parameter in the URL, intended to redirect users to a specific page after successful login. However, the application does not properly validate or sanitize this parameter, allowing an attacker to specify an arbitrary external URL.

Attack Flow:

1. An attacker crafts a malicious URL: https://victim-chamilo.com/login?redirect=https://evil.com/phishing
2. The attacker sends this link to a victim via email, social media, or other channels.
3. The victim clicks the link and is taken to the legitimate Chamilo login page.
4. After the victim enters their credentials and logs in, the application redirects them to https://evil.com/phishing.
5. The attacker can host a fake login page on evil.com to capture the victim's credentials, or simply use the redirect for other malicious purposes.

Root Cause: The redirect parameter is not validated against a whitelist of allowed domains or paths. The application likely uses a simple header("Location: " . $_GET['redirect']) or similar construct without proper sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (Chamilo LMS < 2.0-beta.2):

// login.php (simplified)
$redirect = $_GET['redirect'] ?? '';
// ... authentication logic ...
if ($redirect) {
    header("Location: " . $redirect);
    exit;
}

Patched Code (Chamilo LMS >= 2.0-beta.2):

// login.php (simplified)
$redirect = $_GET['redirect'] ?? '';
// Validate redirect URL
$allowed_hosts = ['chamilo.example.com', 'localhost'];
$parsed_url = parse_url($redirect);
if ($redirect && isset($parsed_url['host']) && !in_array($parsed_url['host'], $allowed_hosts)) {
    $redirect = ''; // or redirect to a default page
}
// ... authentication logic ...
if ($redirect) {
    header("Location: " . $redirect);
    exit;
}

The patch adds a whitelist validation to ensure the redirect URL points to an allowed domain. This prevents the open redirect.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Chamilo LMS instance (version 1.11.x or 2.0-beta.1) using Docker or a local web server.
2. Set up a simple HTTP server to simulate the attacker's malicious site (e.g., python3 -m http.server 8080).
3. Craft the exploit URL.

Exploit URL:

http://victim-chamilo.com/login?redirect=http://attacker.com:8080/phishing

Steps:

1. Send the crafted URL to the victim.
2. Victim logs in to Chamilo.
3. After successful authentication, the victim is redirected to http://attacker.com:8080/phishing.
4. The attacker can host a fake login page to capture credentials.

Note: No public exploit code is available. The above is a manual exploitation technique.

Blue Team

Detection:

• Monitor web server logs for unusual redirect parameter values in requests to /login.
• Look for external domains in the redirect parameter.
• Implement a Web Application Firewall (WAF) rule to block requests with external redirect URLs.

Hunting:

• Search for logs containing login?redirect=http or login?redirect=https where the domain is not internal.
• Use the Sigma rule provided in the Detection Engineering section.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /login with a redirect parameter containing an external domain.
• Subsequent HTTP requests to external domains shortly after a login event.

File IOCs:

• Modified login.php file (if attacker has code execution).
• Suspicious entries in Chamilo access logs.

Log IOCs:

• Web server logs showing GET /login?redirect=http://evil.com or similar.
• Authentication logs showing successful logins followed by redirects to external sites.

Detection Engineering

YARA Rule

rule CVE_2025_66447_Open_Redirect {
    meta:
        description = "Detects open redirect attempts in Chamilo LMS login"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-66447"
    strings:
        $redirect_param = /login\?redirect=https?:\/\/[^\/]/
        $external_domain = /redirect=https?:\/\/(?!.*chamilo)([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}/
    condition:
        $redirect_param and $external_domain
}

Sigma Rule

title: Chamilo LMS Open Redirect via login Redirect Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-66447 by using an external redirect parameter on the Chamilo LMS login page.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/login?redirect='
        cs-uri-query|re: 'redirect=https?:\/\/[^\/]'
    filter:
        cs-uri-query|contains: 'chamilo'  # Allow internal redirects
    condition: selection and not filter
falsepositives:
    - Legitimate internal redirects to other Chamilo pages
level: medium
tags:
    - attack.t1190
    - cve.2025.66447

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66447 Chamilo LMS Open Redirect"; flow:to_server,established; content:"/login"; http_uri; content:"redirect="; http_uri; pcre:"/redirect=https?:\/\/[^\/]/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Chamilo LMS to version 2.0-beta.2 or later. This is the only complete fix.
2. If immediate upgrade is not possible, implement a WAF rule to block external redirects.
3. Manually patch the login.php file to validate the redirect parameter against a whitelist of allowed domains.

Long-term Mitigations:

• Implement a Content Security Policy (CSP) that restricts the domains to which the application can redirect.
• Conduct regular security audits of the codebase.
• Monitor for similar vulnerabilities in other parameters.

Workaround (if patching is delayed):

• Disable the redirect functionality entirely by modifying the code to ignore the redirect parameter.
• Use a reverse proxy to filter out requests with external redirect URLs.

Valters IT Signature:

Valters IT
Cybersecurity & Threat Intelligence

{/* [Security Hash: A61C63FA445ABF7CB136B3FF] */}