Description

ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shib_logout.php runs in a context that ilInitialisation exempts from authentication, and its logout-notification handler locates the session to terminate by reading every live row of the session table and passing each row's stored data to a hand-written parser that calls unserialize without restricting which classes may be constructed. Any serialised object present in any session row is therefore instantiated on behalf of an anonymous request, and object destructors run when those objects are discarded. A serialised object can be placed into a session row without logging in, because the LTI authentication entry point stores request parameters into the session and is reachable on a path the same initialisation code exempts from authentication. A class bundled with the application writes a JSON-encoded structure to a file named by one of its own properties when it is destroyed, which places attacker-controlled content at an attacker-chosen path below the web root and results in code execution as the web server user. Versions 9.22, 10.10 and 11.3 remove the endpoint's logout-notification implementation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T16:16:45.100Z",
  "pubdate": "2026-08-26T16:16:45.100Z",
  "executiveSummary": "A critical PHP object injection vulnerability exists in ILIAS due to insecure deserialization of stored session data.\nThe vulnerability allows an unauthenticated remote attacker to execute arbitrary code with the privileges of the web server user.\nThe flaw resides in the Shibboleth back-channel logout-notification handler, which performs an unrestricted unserialize() operation on data retrieved from the session database table.\nAn attacker can exploit this by leveraging an unauthenticated LTI entry point to inject malicious serialized objects into the session table.\nBy triggering the logout-notification handler, the application instantiates these malicious objects, allowing an attacker to leverage application-bundled classes (gadget chains) to achieve remote code execution through arbitrary file writes.\nThis vulnerability affects ILIAS versions prior to 9.22, 10.10, and 11.3.\nThe risk is severe as it requires no prior authentication and results in full application compromise.",
  "technicalDetails": "The vulnerability originates in the Shibboleth authentication component, specifically within the components/ILIAS/AuthShibboleth/resources/shib_logout.php file. The application's global initialization routine, ilInitialisation, explicitly exempts this endpoint from authentication requirements, allowing any remote user to access it.\nThe logout-notification handler processes session termination by iterating through all live rows in the session database table. For each row, it extracts stored session data and passes it to a custom parser that invokes the PHP unserialize() function. Crucially, this implementation fails to implement any allow-listing or restrictions on the classes that can be instantiated during the deserialization process, creating a classic PHP Object Injection vulnerability.\nThe attack vector is enabled by the LTI authentication entry point. This endpoint is also reachable without authentication and permits the storage of arbitrary request parameters into the session table. An attacker can craft a malicious serialized object payload and use the LTI entry point to write this payload into a new session row.\nOnce the payload is injected into the session store, the attacker triggers the vulnerability by accessing the vulnerable shib_logout.php endpoint. As the application iterates through the sessions to process the logout request, it calls unserialize() on the attacker-controlled data.\nExploitation relies on a 'gadget chain' found within the existing ILIAS codebase. Specifically, the application includes a class that, upon destruction (the magic __destruct() method), writes a JSON-encoded data structure to a filesystem path defined by one of its object properties. By controlling these properties via the injected serialized object, an attacker can manipulate the file path and content, effectively writing a web shell or arbitrary malicious script to a location reachable by the web server.\nBecause the execution context is that of the web server user, the successful instantiation of this gadget allows for arbitrary code execution. The interaction between the LTI session injection and the Shibboleth logout handler results in a chain of events that bypasses all intended security boundaries.\nAffected versions are those where the logout-notification handler is present; specifically, the vulnerability is remediated by removing this implementation in versions 9.22, 10.10, and 11.3."
}