CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated attackers to exploit the Shibboleth logout-notification handler in ILIAS, enabling them to deserialize arbitrary objects from session data. This can lead to remote code execution as the web server user, as attackers can control the content written to a file during object destruction. Organizations using affected versions (prior to 9.22, 10.10, and 11.3) should prioritize immediate remediation to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.