CVE-2015-3272: Moodle open redirect vulnerability
Summary
CVE-2015-3272: Moodle open redirect vulnerability. Affects moodle/moodle across 3 version ranges.
>= 2.7.0, < 2.7.9
>= 2.8.0, < 2.8.7
>= 2.9.0, < 2.9.1
Fixed in 2.7.9, 2.8.7 or 2.9.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, facilitating communication between teachers and students, and delivering educational content. Moodle is written in PHP and relies on a variety of libraries and modules to function effectively.
Vulnerability Detail
The clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 is susceptible to an open redirect vulnerability. This vulnerability allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks. The vulnerability arises from improper handling of the HTTP Referer header, which can be manipulated to include a substring matching a local URL. By exploiting this vulnerability, an attacker can trick users into visiting malicious websites, potentially leading to the disclosure of sensitive information or the installation of malware.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.92.7.9composer require moodle/moodle:2.7.9 -
>= 2.8.0, < 2.8.72.8.7composer require moodle/moodle:2.8.7 -
>= 2.9.0, < 2.9.12.9.1composer require moodle/moodle:2.9.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can modify the clean_param function in lib/moodlelib.php to implement stricter validation of the Referer header. This can be achieved by checking that the Referer header exactly matches the expected local URL or by disallowing any redirects based on the Referer header. However, this workaround should be considered temporary, and updating to the latest patched version of Moodle is the recommended long-term solution.
Conclusion
The open redirect vulnerability in Moodle can have serious consequences, including the compromise of user accounts and the disclosure of sensitive information. It is crucial for administrators to update their Moodle installations to the latest patched versions and review the security settings to mitigate the risk of similar vulnerabilities. Regularly monitoring security advisories and promptly applying updates is essential for maintaining a secure Moodle environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, facilitating communication between teachers and students, and delivering educational content.
An open redirect vulnerability occurs when a web application allows an attacker to redirect users to arbitrary websites. This can be exploited to conduct phishing attacks, where users are tricked into visiting malicious websites that appear legitimate.
The vulnerability in Moodle arises from improper handling of the HTTP Referer header. By manipulating the Referer header to include a substring matching a local URL, an attacker can trick users into visiting arbitrary websites. This can be used to conduct phishing attacks and potentially compromise user accounts or systems.
The open redirect vulnerability in Moodle can lead to various consequences, including the disclosure of sensitive information, the installation of malware or malicious scripts, and the compromise of user accounts. Attackers can use this vulnerability to conduct phishing attacks and trick users into revealing their credentials or other sensitive data.
To protect your Moodle installation, it is recommended to update to the latest patched version of Moodle (2.7.9, 2.8.7, or 2.9.1). Additionally, administrators should review and configure Moodle's security settings to minimize the risk of similar vulnerabilities. Regularly monitoring security advisories and applying updates promptly is crucial for maintaining a secure Moodle installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
