KnowledgeDeliver LMS Hard-Coded Keys RCE | MSSP Advisory

A high-severity vulnerability in Digital Knowledge KnowledgeDeliver Learning Management System was exploited as a zero-day to deploy Godzilla web shells and Cobalt Strike Beacon. The flaw stems from hard-coded ASP.NET machine keys that allow attackers to achieve remote code execution on affected systems. This LMS platform is popular in Japan and the vulnerability has been patched.

Your clients running any LMS platforms face similar risks from hard-coded credentials and poor authentication implementations that create backdoor access for attackers. Once web shells are planted, attackers gain persistent access to move laterally through client networks and deploy post-exploitation tools like Cobalt Strike. The zero-day exploitation window means traditional signature-based detection missed the initial compromise.

📬