ILIAS Application Vulnerability: Critical Deserialization Issue
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- ilias (other)
- Affected versions
- >= v9.21, <= v9.21 or >= v11.2, <= v11.2 or >= v10.9, <= v10.9 or >= v9.20, <= v9.20 or >= v11.1, <= v11.1 or >= v10.8, <= v10.8 or >= v11.0, <= v11.0 or >= v9.19, <= v9.19 or >= v10.7, <= v10.7 or >= v9.18, <= v9.18 or >= v10.6, <= v10.6 or >= v3.8, <= v3.8 or >= v9.17, <= v9.17 or >= v10.5, <= v10.5 or >= v10.4, <= v10.4 or >= v9.16, <= v9.16 or >= v10.3, <= v10.3 or >= v9.15, <= v9.15 or >= v10.2, <= v10.2 or >= v9.13, <= v9.13 or >= v10.0, <= v10.0 or >= v9.12, <= v9.12 or >= v9.10, <= v9.10 or >= v9.8, <= v9.8 or >= v9.7, <= v9.7 or >= v9.6, <= v9.6 or >= v9.5, <= v9.5 or >= v9.4, <= v9.4 or >= v9.3, <= v9.3 or >= v9.1, <= v9.1 or >= v9.0, <= v9.0 or >= v9.0_beta3, <= v9.0_beta3 or >= v9.0_beta1, <= v9.0_beta1 or >= v5.3.0beta1, <= v5.3.0beta1 or >= v5.1.0beta2, <= v5.1.0beta2
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the ILIAS application. The issue involves insecure deserialization of session data, potentially leading to remote code execution.
What happened
The ILIAS application reportedly deserialises stored session data for unauthenticated callers, which may allow remote code execution. The Shibboleth back-channel endpoint is specifically vulnerable due to this insecure deserialization. This vulnerability is under investigation and has not been exploited in the wild as of the latest reports.
Affected versions of ILIAS include a wide range from v9.0_beta1 to v11.2. It is crucial for users of these versions to assess their exposure and take immediate action to mitigate potential risks.
What to do about it
- Upgrade to a version of ILIAS that removes the vulnerable logout-notification implementation.
- If upgrading is not immediately possible, apply a custom fix to mitigate the risk.
- Monitor the primary sources for updates on the vulnerability and any official fixes that may be released.
- Consult the primary sources for detailed version information and specific mitigation strategies.
How 0Day would have caught this
ilias is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using ILIAS versions ranging from v9.0_beta1 to v11.2. Check your current version against this range.
What should I do right now?
Immediately assess your ILIAS version. If you are using a vulnerable version, either upgrade to a secure version or apply a custom fix. Monitor the primary sources for updates.
Is there an official fix available?
No official fix has been published yet. Continue to monitor the primary sources for any updates on patches or mitigations.