CVE-2026-80428 in ILIAS
Summary
by MITRE • 08/26/2026
ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shib_logout.php runs in a context that ilInitialisation exempts from authentication, and its logout-notification handler locates the session to terminate by reading every live row of the session table and passing each row's stored data to a hand-written parser that calls unserialize without restricting which classes may be constructed. Any serialised object present in any session row is therefore instantiated on behalf of an anonymous request, and object destructors run when those objects are discarded. A serialised object can be placed into a session row without logging in, because the LTI authentication entry point stores request parameters into the session and is reachable on a path the same initialisation code exempts from authentication. A class bundled with the application writes a JSON-encoded structure to a file named by one of its own properties when it is destroyed, which places attacker-controlled content at an attacker-chosen path below the web root and results in code execution as the web server user. Versions 9.22, 10.10 and 11.3 remove the endpoint's logout-notification implementation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified involves a critical insecure deserialization flaw within the ILIAS learning management system, specifically affecting versions prior to 9.22, 10.10, and 11.3. The core issue stems from the application’s handling of session data during an unauthenticated logout notification process via the Shibboleth back-channel endpoint located at components/ILIAS/AuthShibboleth/resources/shib_logout.php. This specific script is exempted from standard authentication checks by the ilInitialisation routine, allowing it to be accessed without valid credentials. Upon receiving a request, the handler iterates through every live row in the session database table and passes the stored serialized data for each session into a custom parser function that invokes PHP’s unserialize method. This process lacks any restriction on which classes can be instantiated during deserialization, creating a direct path for arbitrary object injection attacks by an unauthenticated attacker.
The exploitation of this vulnerability relies on two key factors: the lack of authentication required to trigger the deserialization and the ability to inject controlled data into session storage without logging in. The LTI (Learning Tools Interoperability) authentication entry point allows request parameters to be stored directly into the user’s session data. Since this endpoint is also reachable via a path exempted from authentication checks by the same initialization code, an attacker can craft specific HTTP requests that write malicious serialized objects into the session table. Once these objects are persisted in the database, they become eligible for processing during subsequent unauthenticated logout notifications initiated through the vulnerable Shibboleth endpoint. This mechanism effectively bypasses traditional access controls and allows remote code execution under the context of the web server user account.
The operational impact is severe, as it leads to Remote Code Execution (RCE) with high privileges relative to the application environment. The attack leverages a specific class bundled within ILIAS that exhibits dangerous behavior in its destructor method. When an instance of this class is deserialized and subsequently garbage collected, its __destruct function executes code that writes a JSON-encoded structure to a file on the server’s filesystem. Crucially, both the content written to the file and the path where it is saved are derived from properties controlled by the attacker through the serialized object. This capability allows an adversary to write arbitrary files into directories below the web root, potentially placing malicious scripts or configuration files that can be executed by the web server, thereby achieving full system compromise.
From a classification perspective, this vulnerability aligns with CWE-502, which describes Deserialization of Untrusted Data. The attack vector is consistent with ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques used for remote code execution via file write operations. The flaw represents a classic case where application logic fails to validate the integrity or trustworthiness of data retrieved from persistent storage before processing it in a security-sensitive context like object instantiation.
Mitigation strategies primarily involve upgrading ILIAS to version 9.22, 10.10, or 11.3 and later, as these versions have removed the vulnerable logout-notification implementation entirely. For environments where immediate patching is not feasible, administrators should ensure that no unauthenticated endpoints expose session data for processing without strict input validation. Implementing allowlists for deserialization processes to restrict which classes can be instantiated would also mitigate this specific risk vector. Additionally, securing database access and ensuring that only authenticated users can modify session data helps prevent the initial injection of malicious serialized objects into the system state.