Open eClass 3.15 - RCE

The exploit targets a critical Remote Code Execution (RCE) vulnerability in Open eClass version 3.15, identified as CVE-2024-26503. The vulnerability arises from an unrestricted file upload flaw in the administrative badge icon upload functionality, allowing an authenticated user to upload a malicious PHP web shell disguised as an icon file. Once uploaded, the attacker can execute arbitrary system commands via HTTP GET requests to the web shell endpoint. The exploit script automates this process by first authenticating with valid user credentials, uploading the PHP shell, and then providing an interactive command execution interface. The shell code is minimalistic, leveraging PHP's shell_exec function to execute commands passed via the 'cmd' GET parameter. The exploit requires valid login credentials, indicating that the attacker must have some level of authorized access, but no additional privilege escalation is necessary. The code is straightforward, well-structured, and uses Python's requests library for HTTP interactions, demonstrating moderate sophistication suitable for rapid exploitation. Detection can focus on anomalous POST requests to the badge upload endpoint with PHP files, unusual GET requests to the execute.php shell with command parameters, and unexpected creation of execute.php files in badge_templates directories. Forensics would reveal web shell artifacts and suspicious command execution logs. Overall, this exploit leverages a common but critical web application flaw—unrestricted file upload combined with insufficient input validation—to achieve full remote code execution on the server hosting Open eClass 3.15.

In real-world scenarios, this exploit enables attackers with valid credentials to gain full remote code execution on vulnerable Open eClass servers, potentially compromising the entire system. Attack chains could begin with credential theft via phishing or brute force, followed by web shell upload and persistent backdoor establishment. This can lead to data exfiltration, defacement, ransomware deployment, or lateral movement within the network. Educational institutions and enterprises using Open eClass for e-learning are at high risk, as attackers can manipulate course content, steal sensitive student or staff data, or disrupt operations. Government agencies and critical infrastructure entities using this platform could face espionage or sabotage. The exploit’s ability to execute arbitrary commands allows attackers to pivot and escalate privileges, potentially compromising connected systems. Secondary impacts include reputational damage, regulatory penalties, and long-term persistence through implanted backdoors. The exploit’s simplicity and automation increase its weaponization potential in targeted attacks and opportunistic campaigns alike.

Immediate containment requires disabling the vulnerable badge icon upload functionality or restricting it to trusted administrators only. A comprehensive patching strategy involves applying the official Open eClass 3.15 security update that fixes the unrestricted file upload vulnerability by enforcing strict file type validation and sanitization. Network segmentation should isolate the Open eClass server from critical internal resources to limit lateral movement. Access controls must enforce strong authentication and least privilege principles for all users. Detection rules should monitor HTTP POST requests to '/modules/admin/certbadge.php' containing PHP files and GET requests to '/courses/user_progress_data/badge_templates/execute.php' with 'cmd' parameters. Intrusion detection systems can flag anomalous command execution patterns and unexpected file creations. Long-term security posture improvements include implementing Web Application Firewalls (WAFs) with file upload inspection, regular security audits, multi-factor authentication, and continuous monitoring of web server logs for suspicious activity.