Summary
ILIAS contains a PHP object injection vulnerability in the handling of crafted Test archives, where attacker-controlled serialized data can be passed to PHP's unserialize() function. An authenticated user with Test creation or import permission may exploit this behavior to write PHP files and potentially execute arbitrary code on the server.
ILIAS contains a PHP object injection vulnerability in the handling of crafted Test archives, where attacker-controlled serialized data can be passed to PHP's unserialize() function. An authenticated user with Test creation or import permission may exploit this behavior to write PHP files and potentially execute arbitrary code on the server.
Affected context
The vulnerability occurs in ILIAS deployments that allow authenticated users to create or import Tests and process Test archive content. It becomes risky when archive metadata, including the tst_sequence sequence attribute, reaches an unsafe deserialization path without sufficient structural validation or object restrictions. The described affected releases are ILIAS versions before 9.24, 10.12, and 11.5.
The vulnerability occurs in ILIAS deployments that allow authenticated users to create or import Tests and process Test archive content. It becomes risky when archive metadata, including the tst_sequence sequence attribute, reaches an unsafe deserialization path without sufficient structural validation or object restrictions. The described affected releases are ILIAS versions before 9.24, 10.12, and 11.5.
Exploit preconditions
- Attack surface: Test archive creation or import functionality
- Required access: An authenticated account with permission to create or import Tests
- Trigger point: Processing a crafted Test archive containing a malicious sequence attribute
- Why exploitation is possible: Attacker-controlled serialized data is passed to
unserialize(), allowing available gadget chains to perform unintended file and code operations
- Attack surface: Test archive creation or import functionality
- Required access: An authenticated account with permission to create or import Tests
- Trigger point: Processing a crafted Test archive containing a malicious sequence attribute
- Why exploitation is possible: Attacker-controlled serialized data is passed to
unserialize(), allowing available gadget chains to perform unintended file and code operations
Why this happens
The underlying flaw is unsafe deserialization of attacker-influenced data. PHP's unserialize() can instantiate objects and invoke magic methods or other gadget-chain behavior when supplied with crafted serialized input. In this case, reachable Guzzle or Monolog gadgets may enable PHP file creation and code execution, mapping the issue to CWE-502: Deserialization of Untrusted Data.
The underlying flaw is unsafe deserialization of attacker-influenced data. PHP's unserialize() can instantiate objects and invoke magic methods or other gadget-chain behavior when supplied with crafted serialized input. In this case, reachable Guzzle or Monolog gadgets may enable PHP file creation and code execution, mapping the issue to CWE-502: Deserialization of Untrusted Data.
Potential impact
- An attacker may write malicious PHP files within the application's accessible filesystem
- Arbitrary server-side code could be executed with the privileges of the ILIAS process
- Application data and user accounts could be compromised
- The host could be used for persistence, lateral movement, or further attacks
- Stored Tests or imported content could be altered or weaponized
- An attacker may write malicious PHP files within the application's accessible filesystem
- Arbitrary server-side code could be executed with the privileges of the ILIAS process
- Application data and user accounts could be compromised
- The host could be used for persistence, lateral movement, or further attacks
- Stored Tests or imported content could be altered or weaponized
General mitigation guidance
Mitigation generally focuses on removing unsafe deserialization from archive-processing paths and reducing trust in imported content.
Common defensive patterns include:
- Replacing native object deserialization with a safe, data-only format and explicit schema mapping
- Avoiding deserialization of attacker-controlled object graphs
- Validating archive structure, metadata types, sizes, and allowed fields before processing
- Restricting the classes and behaviors available to any unavoidable deserialization mechanism
- Preventing the web application account from writing executable files or sensitive directories
- Applying least privilege to the ILIAS process, filesystem, database, and deployment environment
- Separating import processing from privileged application components where practical
Mitigation generally focuses on removing unsafe deserialization from archive-processing paths and reducing trust in imported content.
Common defensive patterns include:
- Replacing native object deserialization with a safe, data-only format and explicit schema mapping
- Avoiding deserialization of attacker-controlled object graphs
- Validating archive structure, metadata types, sizes, and allowed fields before processing
- Restricting the classes and behaviors available to any unavoidable deserialization mechanism
- Preventing the web application account from writing executable files or sensitive directories
- Applying least privilege to the ILIAS process, filesystem, database, and deployment environment
- Separating import processing from privileged application components where practical
How teams detect issues like this
Detection approaches can include:
- Static analysis rules identifying calls to
unserialize()on request, archive, upload, or import-derived data - Code review checks for object deserialization before schema validation or authorization
- Dependency and gadget-surface reviews covering libraries such as Guzzle and Monolog
- Runtime monitoring for unexpected PHP file creation, modified application files, or child-process activity by the web service
- Policy enforcement that restricts executable file creation in upload and import directories
- Automated security review tools that flag unsafe deserialization and archive-processing patterns
Detection approaches can include:
- Static analysis rules identifying calls to
unserialize()on request, archive, upload, or import-derived data - Code review checks for object deserialization before schema validation or authorization
- Dependency and gadget-surface reviews covering libraries such as Guzzle and Monolog
- Runtime monitoring for unexpected PHP file creation, modified application files, or child-process activity by the web service
- Policy enforcement that restricts executable file creation in upload and import directories
- Automated security review tools that flag unsafe deserialization and archive-processing patterns
