A Server-Side Request Forgery vulnerability in Chamilo LMS allows authenticated attackers to perform unauthorized requests against internal infrastructure, posing a significant risk of internal network exposure.

This vulnerability is a Server-Side Request Forgery (SSRF) flaw occurring in the read_url_with_open_graph endpoint. An authenticated attacker can supply a malicious URL via the social_wall_new_msg_main POST parameter, forcing the server to conduct internal requests without proper validation.

The exploitation of this vulnerability could lead to severe internal network compromise, including port scanning and unauthorized access to sensitive cloud metadata services. With a CVSS score of 7.7, this is a High severity issue that, if successfully executed, could result in the exfiltration of internal configuration data or facilitate further lateral movement within the network.

Immediate Action: Upgrade to Chamilo LMS version 1.11.38 or 2.0.0-RC.3 immediately to incorporate the provided security patches.

Proactive Monitoring: Review web server and application access logs for suspicious POST requests directed at the Social Wall feature containing internal IP addresses or sensitive service URLs.

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to internal network segments and restricted cloud metadata endpoints.

Public Exploit Available: Unknown

Given the high CVSS severity and the potential for internal network discovery, administrators should prioritize this update. Ensure that all instances of Chamilo LMS are patched to the specified versions to eliminate the SSRF vector and protect internal infrastructure from unauthorized requests.