Moodle XML Import of ddwtos Remote Code Execution
Summary
CVE-2018-14630: Moodle XML import of ddwtos could lead to intentional remote code execution. Affects moodle/moodle across 4 version ranges.
< 3.1.14
>= 3.2.0, < 3.3.8
>= 3.4.0, < 3.4.5
>= 3.5.0, < 3.5.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system used by educational institutions worldwide. It provides a platform for creating and managing online courses, quizzes, and assessments. The Moodle package, specifically versions 3.5.0 to 3.5.1, 3.4.0 to 3.4.4, 3.2.0 to 3.3.7, and 3.1.0 to 3.1.13, is susceptible to a remote code execution vulnerability when importing XML files containing 'drag and drop into text' (ddwtos) type quiz questions. This vulnerability allows an attacker to inject and execute PHP code within the imported questions, potentially leading to unauthorized access and control of the Moodle instance.
Vulnerability Detail
The vulnerability arises from a lack of proper input validation and sanitization during the XML import process. By crafting malicious XML files with embedded PHP code, an attacker can exploit this vulnerability to execute arbitrary commands on the server hosting the Moodle instance. This can result in various consequences, including unauthorized data access, privilege escalation, and potential compromise of the entire Moodle system. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.143.1.14composer require moodle/moodle:3.1.14 -
>= 3.2.0, < 3.3.83.3.8composer require moodle/moodle:3.3.8 -
>= 3.4.0, < 3.4.53.4.5composer require moodle/moodle:3.4.5 -
>= 3.5.0, < 3.5.23.5.2composer require moodle/moodle:3.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the XML import functionality in Moodle to prevent potential exploitation. This can be achieved by modifying the Moodle configuration to restrict access to the XML import feature or by removing the XML import plugin altogether. However, this workaround may limit the functionality of Moodle and should only be considered until the system can be upgraded to a patched version.
Conclusion
The Moodle XML import vulnerability poses a significant risk to Moodle instances running affected versions. It allows attackers to execute arbitrary PHP code, potentially compromising the entire system. To mitigate this risk, it is crucial to upgrade to the latest patched version of Moodle. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
This vulnerability allows an attacker to execute arbitrary PHP code on the server hosting the Moodle instance, potentially leading to unauthorized access and control of the system.
To fix this vulnerability, it is recommended to upgrade to the latest version of Moodle (3.5.2, 3.4.5, 3.3.8, or 3.1.14) where the issue has been addressed.
Yes, users can temporarily disable the XML import functionality in Moodle to mitigate the risk of exploitation. However, this may limit the system's functionality and should only be considered until the upgrade can be performed.
The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
