Executive brief
ATutor is a learning management system used to deliver and manage online courses. An authenticated administrator can exploit a server-side request forgery vulnerability in the import functionality to make the ATutor server send requests to internal HTTP endpoints, cloud metadata services, or local files via file:// protocol, potentially exposing sensitive internal data or credentials.
Technical details
This is a server-side request forgery (SSRF) vulnerability in ATutor's import functionalities. The vulnerability allows an authenticated administrator to inject arbitrary URLs (including internal HTTP endpoints, cloud metadata services, or file:// URIs if PHP environment permits URL wrappers) that the server will attempt to fetch. Attack requires admin-level authentication and knowledge of the import functionality endpoints. An attacker can retrieve sensitive data from internal services, query cloud metadata APIs (e.g., AWS metadata endpoint 169.254.169.254), or read local files. ATutor 2.2.4 is confirmed vulnerable; other versions untested but likely also affected. No patch is available as the product is no longer actively maintained.
Affected products
- ATutor ATutor 2.2.4 (confirmed); other versions likely affected
Timeline
- 2026-08-20: disclosed