Chamilo LMS's Social Wall feature includes an endpoint, read_url_with_open_graph, which accepts a user-supplied URL via the social_wall_new_msg_main POST parameter. In affected versions, the server performs two HTTP requests to this URL without validating whether the target is internal or external, enabling Server-Side Request Forgery (CWE-918). An authenticated attacker can exploit this to force the server to access internal services, scan internal ports, and retrieve sensitive metadata from cloud instances. The issue is resolved in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3.

An authenticated attacker can exploit this SSRF vulnerability to make the server send arbitrary HTTP requests to internal network resources or external endpoints. This can lead to unauthorized internal port scanning and access to sensitive cloud instance metadata, potentially exposing confidential information. The vulnerability does not impact confidentiality of user data directly but can facilitate further attacks by revealing internal infrastructure details. There is no indication of denial of service or integrity impact.

This vulnerability is fixed in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3. Users should upgrade to at least these versions to remediate the issue. No official patch links were provided, but upgrading to the fixed versions is the recommended action. Until upgrading, restrict access to the Social Wall feature to trusted authenticated users and monitor for suspicious activity related to URL submissions if possible.