Canvas LMS Vulnerability: Portals Modification and Response Guide
Learn how to manage portal manipulation vulnerability on Canvas LMS and protect your system.
Contents
Canvas LMS Vulnerability and Manipulation of Portals
A security vulnerability detected in the Canvas LMS platform developed by Instructure allowed unauthorized persons to add or 'deface' content by changing the login portals. This situation poses a serious security risk for educational institutions and may lead to users being exposed to phishing attacks.
Problem Description
Using a vulnerability in the Canvas infrastructure, attackers placed malicious messages on private login pages or directed users to misleading external links. This situation damages the reliability of the platform and jeopardizes corporate data security.
Solution and Prevention Steps
Review Commands
You can use the following commands to check suspicious access logs on the server side:
# Filtering login attempts
grep "login" /var/log/canvas/access.log | tail -n 50
# Checking for suspicious file changes
find /var/www/canvas/public -mtime -1 -lsWarning: If you notice unusual content or redirection on your portal, immediately contact Canvas technical support and terminate all admin sessions.
In accordance with your corporate security policies, it is critical that all users be informed to change their passwords periodically and not to click on suspicious links.