CVE-2014-0214: MoodleMobile Web-Service Token Hijacking
Summary
CVE-2014-0214: Moodle creates a MoodleMobile web-service token with an infinite lifetime. Affects moodle/moodle across 3 version ranges.
< 2.4.10
>= 2.5.0, < 2.5.6
>= 2.6.0, < 2.6.3
Fixed in 2.4.10, 2.5.6 or 2.6.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides various features for course administration, content creation, and student engagement. Moodle allows the creation of web-service tokens for accessing its mobile app, MoodleMobile. These tokens are used to authenticate and authorize requests made by the app to the Moodle server.
Vulnerability Detail
The vulnerability identified as CVE-2014-0214 affects Moodle versions 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3. The issue lies in the creation of MoodleMobile web-service tokens, which are assigned an infinite lifetime. This design flaw makes it easier for remote attackers to hijack user sessions by performing brute-force attacks against the tokens. By guessing or systematically trying different tokens, an attacker can gain unauthorized access to Moodle accounts and potentially compromise sensitive information or perform malicious actions on behalf of the user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.102.4.10composer require moodle/moodle:2.4.10 -
>= 2.5.0, < 2.5.62.5.6composer require moodle/moodle:2.5.6 -
>= 2.6.0, < 2.6.32.6.3composer require moodle/moodle:2.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, administrators can mitigate the risk by closely monitoring their Moodle installations for any suspicious activity and promptly applying the available patches or upgrades.
Conclusion
The vulnerability in MoodleMobile web-service token creation poses a significant risk to Moodle installations. Upgrading to the latest patched versions is crucial to mitigate the risk of session hijacking. Administrators should also remain vigilant and promptly apply any available security patches or upgrades. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
MoodleMobile is a mobile app that allows users to access Moodle courses and resources on their smartphones or tablets.
Web-service tokens in Moodle are used to authenticate and authorize requests made by the MoodleMobile app to the Moodle server.
The vulnerability allows remote attackers to hijack user sessions by performing brute-force attacks against MoodleMobile web-service tokens.
Administrators should upgrade their Moodle installations to the latest patched versions and closely monitor for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
