提出 #705318: Frappe Frappe LMS 2.40.0 Improper Access Controls

Frappe LMS 2.40.0 – Access to Unpublished Courses via Predictable Slugs

Summary
Frappe LMS version 2.40.0 is vulnerable to an access control bypass where unpublished course content remains accessible through predictable slug-based URLs. Although direct access to an unpublished course page (e.g. /lms/courses/linux-administration/) correctly redirects to the courses listing, an attacker can still access course content and lessons via URLs such as /lms/courses/linux-administration/learn/1-1, even if the course is not published.

Vulnerability Details
The application enforces publication checks on the course overview endpoint, but fails to consistently enforce them on lesson/learning endpoints under the /learn/[chapter]-[item] structure.

Key points:
- Unpublished courses should not be accessible to students or unauthenticated users.
- The slug pattern /lms/courses/[COURSE_NAME]/learn/1-1 exposes chapter and lesson content even when the course is unpublished.
- A student can also enroll into an unpublished course by accessing these direct URLs.

This constitutes a broken access control vulnerability. It's a bypass for CVE-2025-11281.

CVSS v3.1 Base Score: 7.5 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Steps to Reproduce
1. Log in as an instructor.
- Navigate to the courses page: /lms/courses

2. Create a new course.
- Create a course (e.g. linux-administration).
- Add at least one chapter and one lesson or assignment in Chapter 1.

3. Ensure the course is unpublished.
- In the course settings, leave the “Published” checkbox unchecked.

4. Attempt to access the course overview (blocked as expected).
- As a student or unauthenticated user, open: /lms/courses/linux-administration/
- You are redirected to the courses page.

5. Bypass using the predictable lesson slug.
- As a student or unauthenticated user, open: /lms/courses/linux-administration/learn/1-1
- Chapter and lesson names and content are accessible even though the course is unpublished.

6. Test with other course names.
- For any known course slug, access: /lms/courses/[COURSE_NAME]/learn/1-1
- You may be able to view unpublished course content and in some cases enroll or continue learning.

Impact
- Exposure of unpublished course content: Draft or embargoed material can be accessed early.
- Leakage of lesson/assignment content: Attackers can view course structure, lessons, assignments, and exam-like material.
- Predictable enumeration: Slugs such as learn/1-1, learn/1-2, etc., make enumeration trivial.
- Business/academic integrity risk: Unauthorized access to course material can undermine schedules, exam integrity, or paid content models.

This is a high-impact confidentiality issue because it breaks the core publish/unpublish model of the LMS.

• ソース: ⚠️ https://gist.github.com/0xHamy/d978d5dc2730b2b2c10649255f067a34
• ユーザー: 0xHamy (UID 88518)
• 送信: 2025年12月02日 19:57 (10 月 ago)
• モデレーション: 2025年12月10日 08:23 (8 days later)
• ステータス: 重複
• VulDBエントリ: 327015 [Frappe LMS 2.35.0 Unpublished Course /courses/ 特権昇格]
• ポイント: 0