ILIAS Deserialization Vulnerability in Base64 Decoding Handler Allowing Remote Code Execution

A critical deserialization vulnerability has been identified in ILIAS versions prior to 8.24, 9.14, and 10.2. The issue arises in the Base64 Decoding Handler, where the 'f_settings' parameter can be manipulated to perform unsafe deserialization. This vulnerability can be exploited remotely, allowing an attacker to execute arbitrary code by sending a crafted payload via a POST request.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server where ILIAS is running.

Remediation

Users are advised to upgrade to ILIAS versions 8.24, 9.14, or 10.2.