[HN Gopher] Three RCEs in Ilias Learning Management System
       ___________________________________________________________________
        
       Three RCEs in Ilias Learning Management System
        
       Author : hack223
       Score  : 22 points
       Date   : 2026-01-23 15:48 UTC (7 hours ago)
        
 (HTM) web link (srlabs.de)
 (TXT) w3m dump (srlabs.de)
        
       | hannob wrote:
       | Okay, story time: back in 2018, the German government's foreign
       | ministry was hacked.
       | 
       | At the time, a colleague of mine (we were both working for the
       | German IT news magazine Golem) found a web page by a government-
       | associated university that was offline with a message that it's
       | been taken down due to a security issue.
       | 
       | Putting a few hints together, we figured out that Ilias was
       | hosted therer, and that this was how the attack on the government
       | initially started.
       | 
       | We weren't able to figure out which vulnerability was used, but
       | had some ideas what it might've been. (Older versions had a
       | default password for the admin account.)
       | 
       | One wonders: there's an Open Source software that's widely used
       | by universities, even by government-associated universities. It's
       | been the cause of a high-profile attack on a government before.
       | One wonders why that doesn't trigger sufficient funding for
       | regular, high-quality security audits of that software.
       | 
       | Article from 2018: https://www.golem.de/news/government-hack-
       | hack-on-german-gov...
        
       | quibono wrote:
       | Re: the unauthenticated RCE (CVE-2025-11344), am I to understand
       | that Apache will read and honour any .htaccess file it finds,
       | even outside of the config root path? The lack of file clean-up
       | when handling the exception is one thing... but this .htaccess
       | logic strikes me as a bizarre default (if true).
        
         | formerly_proven wrote:
         | Yes, Apache reads and honors .htaccess at every directory level
         | for every request. 'twas how we did things before nginx with
         | its pesky, centrally-sanctioned configuration that you had to
         | manually reload.
        
       ___________________________________________________________________
       (page generated 2026-01-23 23:01 UTC)