ILIAS Deserialization Vulnerability in Test Import Component Allowing Authenticated Remote Code Execution

A deserialization vulnerability has been identified in ILIAS versions 8.0.0 through 8.23, 9.0 through 9.13, and 10.0 through 10.1. The issue arises in the Test Import component, where the 'unserialize' function improperly handles user-supplied data. This flaw allows for remote exploitation, with authenticated users able to execute arbitrary code by crafting a specific payload that is processed during the import process.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server where ILIAS is running.

Reproduction

To reproduce this vulnerability, an authenticated user must upload an XML file through the Test Import feature. This XML file can be crafted to include a payload that exploits the deserialization process, using a gadget chain such as Monolog to execute arbitrary code on the server.

Remediation

Users are advised to upgrade to ILIAS versions 8.24, 9.14, or 10.2.