An unauthenticated server-side request forgery vulnerability in Chamilo LMS allows remote attackers to bypass network perimeters and potentially exfiltrate sensitive cloud instance credentials.

The vulnerability exists within the PENS plugin endpoint at public/plugin/Pens/pens.php, which lacks authentication checks and fails to validate the user-supplied package-url parameter. This enables unauthenticated attackers to force the server to perform arbitrary requests to internal network resources or cloud metadata services.

The ability to perform unauthenticated SSRF poses a significant risk to organizational infrastructure. With a CVSS score of 8.6, this flaw permits attackers to bypass firewalls to scan internal services, access sensitive cloud environment metadata, or steal IAM credentials, which could lead to a full compromise of the cloud instance and lateral movement within the private network.

Immediate Action: Upgrade Chamilo LMS to version 2.0.0-RC.3 or higher to incorporate the necessary authentication checks and input validation.

Proactive Monitoring: Monitor server access logs for unusual requests to the public/plugin/Pens/pens.php endpoint and review egress traffic logs for connections to internal IP ranges or metadata service addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing suspicious URL patterns targeting private IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 192.168.0.0/16) directed at the PENS plugin endpoint.

Public Exploit Available: Yes, a public proof-of-concept repository is available on GitHub.

Given the high CVSS severity and the ease of exploitation, this vulnerability represents an immediate threat to the confidentiality and integrity of the hosting environment. Organizations utilizing Chamilo LMS must prioritize upgrading to the patched version immediately to eliminate the SSRF vector and prevent unauthorized access to internal network resources.