A critical vulnerability in ILIAS allows unauthenticated attackers to achieve remote code execution by leveraging unsafe deserialization of session data.

The application performs unsafe deserialization of untrusted session data within the Shibboleth logout-notification handler. Because this endpoint is reachable by unauthenticated callers, an attacker can trigger the instantiation of arbitrary classes, leading to remote code execution as the web server user.

This vulnerability carries a CVSS score of 9.8, indicating a critical severity level due to the potential for full system compromise. Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the web server, which may lead to total data loss, unauthorized access to sensitive educational records, and complete service disruption.

Immediate Action: Update the ILIAS installation to version 9.22, 10.10, 11.3, or later immediately to remove the vulnerable logout-notification implementation.

Proactive Monitoring: Review web server and application access logs for suspicious requests directed at the components/ILIAS/AuthShibboleth/resources/shib_logout.php endpoint.

Compensating Controls: If patching is not immediately feasible, restrict access to the affected Shibboleth logout endpoint at the network or Web Application Firewall (WAF) level to prevent unauthorized requests.

Public Exploit Available: Unknown

Given the critical nature of this flaw and the potential for full remote code execution, organizations must prioritize upgrading their ILIAS instances. Applying the vendor-provided patches is the only definitive way to eliminate the risk of exploitation. Failure to update may leave systems exposed to full compromise by unauthenticated remote actors.