CVE-2023-4220

Chamilo LMS is a free software e-learning and content management system. In versions prior to <= v1.11.24 a webshell can be uploaded via the bigload.php endpoint. If the GET request parameter action is set to post-unsupported file extension checks are skipped allowing for attacker controlled .php files to be uploaded to: /main/inc/lib/javascript/bigupload/files/ if the /files/ directory already exists - it does not exist by default. The required directory /files/ has been added to this container for vulnerability testing purposes.

This docker setup was entirely copied from https://github.com/22phuber/docker-compose-chamilo-lms. The original Dockerfile had the Chamilo version set to 1.11.12 which is unaffected by the vulnerability as it doesn't have the /bigupload/ endpoint. The base version of PHP was updated, as well as some necessary packages to prevent the build from failling. The version of Chamilo was updated to 1.11.18 which is affected by CVE-2023-4220 also as mentioned the necessary dierctory /files/ has been added as well. Thanks to 22phuber for all the hard work.

Chamilo LMS docker-compose

A simple docker-compose setup for Chamilo LMS.

Official Docker Hub images used:

• php (7.x-apache)
• mariadb (latest)

Chamilo LMS on Github: https://github.com/chamilo/chamilo-lms

This setup doesn't directly install/configure Chamilo. You have to use the Chamilo installation wizard once the docker containers are up.

*This setup works with Chamilo version 1.11.x

Optional: Host system config

On the Host system you need to add a /etc/hosts entry for the domain name configured in the apache vhost:

sudo echo "127.0.0.1 docker.chamilo.net" >> /etc/hosts

.../etc/hosts on Windows:

• Open a text editor as administrator (with administrator privileges)
• Open hosts file: C:\Windows\System32\Drivers\etc\hosts
• Add entry 127.0.0.1 docker.chamilo.net at the end of the file and save.

ENV Variables

environment variables for MYSQL

You can define mysql username, password and database name in the docker-compose config:

    ...
    environment:
      - MYSQL_ROOT_PASSWORD=pass
      - MYSQL_USER=chamilo
      - MYSQL_PASSWORD=chamilo
      - MYSQL_DATABASE=chamilo
    ...

args variables for building Chamilo

You can define the Version for Chamilo with CHAMILO_VERSION.
And you have to set the CHAMILO_TAR filename due to incosistent naming.
Check for .tar.gz filenames here: https://github.com/chamilo/chamilo-lms/releases

Example in docker-compose.yml:

      args:
        - CHAMILO_VERSION=1.11.10
        - CHAMILO_TAR=chamilo-1.11.10-php7.3.tar.gz

The args settings in docker-compose.yml will override the ARG settings in the Dockerfile.
If you remove the args in docker-compose.yml, the "fallback" values from the Dockerfile will be used.

Build & Run

Build:

Build chamilo docker image

docker-compose -f docker-compose.yml build

Run:

docker-compose -f docker-compose.yml up

Database connection step in web installation wizard

The "Database Host" in step 4 of the mysql connections settings has to be the name of the docker image defined in the appropriate docker-compose.yml.

Database Host: mariadb

Access Chamilo Website

Access Chamilo URL with /etc/hosts entry:

http://docker.chamilo.net:8080/

Without /etc/hosts entry:

http://localhost:8080