CVE-2024-34003: Moodle Authenticated LFI risk in some misconfigured shared hosting environments
Summary
CVE-2024-34003: Moodle Authenticated LFI risk in some misconfigured shared hosting environments. Affects moodle/moodle across 3 version ranges.
< 4.1.10
>= 4.2.0, < 4.2.7
>= 4.3.0, < 4.3.4
Fixed in 4.1.10, 4.2.7 or 4.3.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-34003 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage and organize course materials, assessments, and collaborative activities. Moodle is widely used and has a large community of developers and users. However, in some misconfigured shared hosting environments, Moodle is vulnerable to an authenticated local file inclusion (LFI) attack.
Vulnerability Detail
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include. This vulnerability can be exploited by an authenticated user to access sensitive files on the server, potentially leading to unauthorized access, data leakage, or remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10composer require moodle/moodle:4.1.10 -
>= 4.2.0, < 4.2.74.2.7composer require moodle/moodle:4.2.7 -
>= 4.3.0, < 4.3.44.3.4composer require moodle/moodle:4.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the Moodle software is not immediately possible, a temporary workaround is to restrict access to the Moodle user's account and prevent direct access to the web server outside of the Moodle webroot. This can be achieved by configuring the web server's access controls and permissions appropriately.
Conclusion
In conclusion, Moodle is vulnerable to an authenticated local file inclusion (LFI) attack in some misconfigured shared hosting environments. It is important to ensure that the shared hosting environment is properly configured and to update the Moodle software to the latest version to mitigate this vulnerability. Regularly updating and patching the underlying web server and operating system is also recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
A shared hosting environment is a hosting setup where multiple websites or applications share the same server resources.
A local file inclusion (LFI) attack is a type of vulnerability that allows an attacker to include files from the target system's local file system.
This vulnerability can be exploited by an authenticated Moodle user who has access to restore workshop modules and direct access to the web server outside of the Moodle webroot.
The potential consequences of this vulnerability include unauthorized access to sensitive files, data leakage, and remote code execution.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
