CVE-2008-5153: Moodle vulnerable to symlink attack
Summary
CVE-2008-5153: Moodle vulnerable to symlink attack. Affects moodle/moodle across 4 version ranges.
>= 1.6.0, < 1.6.9
>= 1.7.0, < 1.7.7
>= 1.8.0, < 1.8.8
>= 1.9.0, < 1.9.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for teachers to create and deliver content, and for students to access and interact with that content. Moodle is written in PHP and relies on a database to store course materials, user information, and other data. This vulnerability affects Moodle versions 1.9.0 to 1.9.4, 1.8.0 to 1.8.8, 1.7.0 to 1.7.7, and 1.6.0 to 1.6.9.
Vulnerability Detail
The vulnerability in Moodle, identified as CVE-2008-5153, allows local users to overwrite arbitrary files through a symlink attack on temporary files used by the spell-check-logic.cgi script. By creating symbolic links to sensitive files, an attacker can manipulate the content of these files, potentially leading to unauthorized access, data corruption, or other malicious activities. The specific files targeted by the symlink attack are /tmp/spell-check-debug.log, /tmp/spell-check-before, and /tmp/spell-check-after.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.6.0, < 1.6.91.6.9composer require moodle/moodle:1.6.9 -
>= 1.7.0, < 1.7.71.7.7composer require moodle/moodle:1.7.7 -
>= 1.8.0, < 1.8.81.8.8composer require moodle/moodle:1.8.8 -
>= 1.9.0, < 1.9.41.9.4composer require moodle/moodle:1.9.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of Moodle is not immediately feasible, a temporary workaround is to ensure that the permissions for the temporary files (/tmp/spell-check-debug.log, /tmp/spell-check-before, and /tmp/spell-check-after) are properly set to prevent unauthorized modification. Additionally, monitoring the system for any suspicious activity related to these files can help detect and mitigate potential attacks.
Conclusion
In conclusion, the vulnerability in Moodle allows local users to perform symlink attacks and overwrite arbitrary files. To mitigate this issue, it is crucial to update to the latest version of Moodle or apply the recommended workaround. Regular monitoring and security best practices should be followed to ensure the integrity and security of the Moodle installation.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management.
This vulnerability affects Moodle versions 1.9.0 to 1.9.4, 1.8.0 to 1.8.8, 1.7.0 to 1.7.7, and 1.6.0 to 1.6.9.
A symlink attack, or symbolic link attack, is a technique where an attacker creates symbolic links to manipulate the behavior of a system or gain unauthorized access to files or directories.
The symlink attack vulnerability in Moodle can lead to unauthorized access, data corruption, or other malicious activities by allowing local users to overwrite arbitrary files.
To mitigate this vulnerability, it is recommended to upgrade to the latest version of Moodle (1.9.4, 1.8.8, 1.7.7, or 1.6.9). Alternatively, ensure proper permissions for the temporary files and monitor for suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
