Executive brief
EduSoho, a popular open-source online education and training platform, contains a security flaw that allows unauthorized individuals to read sensitive files from the server. By exploiting this vulnerability, an attacker can access critical configuration files containing database passwords and secret encryption keys. This information could be used to gain full control over the website, steal user data, or disrupt educational services.
Technical details
An arbitrary file read vulnerability exists in EduSoho versions prior to 22.4.7 due to improper input validation in the 'classroom-course-statistics' export functionality. Specifically, the 'fileNames[]' parameter is susceptible to path traversal sequences (e.g., ../../../). A remote, unauthenticated attacker can exploit this to read arbitrary files from the server's filesystem, such as 'config/parameters.yml'. Access to this file exposes database credentials and the application 'secret' value; the latter can be further leveraged to achieve Remote Code Execution (RCE) via Symfony's '_fragment' routing. The vulnerability has been addressed in version 22.4.7.
Affected products
- Hangzhou Kuozhi Network Technology Co., Ltd. EduSoho < 22.4.7
Timeline
- 2024-01-04: patched: Vendor released version 22.4.7 to address security vulnerabilities.
- 2026-01-19: exploited: Exploitation evidence observed by Shadowserver Foundation.
- 2026-01-22: advisory: NVD and VulnCheck published advisory details.
References
- https://blog.csdn.net/qq_41904294/article/details/135007351
- https://cn-sec.com/archives/2451582.html
- https://github.com/edusoho/edusoho/releases/tag/v22.4.7
- https://github.com/gobysec/GobyVuls/blob/master/CNVD-2023-03903.md
- https://github.com/zeroChen00/exp-poc/blob/main/EduSoho%E6%95%99%E5%9F%B9%E7%B3%BB%E7%BB%9Fclassropm-course-statistics%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
- https://www.cnvd.org.cn/flaw/show/CNVD-2023-03903
- https://www.edusoho.com/