CVE-2024-34004: Moodle Authenticated LFI risk in some misconfigured shared hosting environments
Summary
CVE-2024-34004: Moodle Authenticated LFI risk in some misconfigured shared hosting environments. Affects moodle/moodle across 3 version ranges.
< 4.1.10
>= 4.2.0, < 4.2.7
>= 4.3.0, < 4.3.4
Fixed in 4.1.10, 4.2.7 or 4.3.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-34004 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a wide range of features for course management, content creation, and collaboration. Moodle is built using PHP and relies on a web server to serve its content. In some shared hosting environments, the server may be misconfigured, allowing access to other users' content. This misconfiguration introduces a vulnerability that can be exploited by a Moodle user with access to restore wiki modules and direct access to the web server outside of the Moodle webroot.
Vulnerability Detail
The vulnerability in Moodle allows an authenticated user to execute a local file include (LFI) attack. By leveraging the misconfigured shared hosting environment, an attacker can access files outside of the Moodle webroot, potentially exposing sensitive information or executing arbitrary code. This can lead to unauthorized access, data leakage, or even remote code execution on the server. The vulnerability has a moderate severity rating.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10composer require moodle/moodle:4.1.10 -
>= 4.2.0, < 4.2.74.2.7composer require moodle/moodle:4.2.7 -
>= 4.3.0, < 4.3.44.3.4composer require moodle/moodle:4.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the patched versions is not immediately feasible, a temporary workaround is to restrict access to the Moodle user account with restore wiki module privileges. This can be done by adjusting the user permissions within the Moodle administration settings. By limiting the user's access, the risk of exploitation can be reduced.
Conclusion
The Moodle Authenticated LFI vulnerability in misconfigured shared hosting environments can lead to unauthorized access and potential data leakage. It is crucial to promptly upgrade to the patched versions of Moodle and ensure proper configuration of the hosting environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for online course management and collaboration.
A shared hosting environment is a web hosting setup where multiple websites are hosted on a single server, sharing its resources.
A local file include (LFI) attack is a type of vulnerability that allows an attacker to include files from the local file system of a server.
The potential consequences of this vulnerability include unauthorized access to sensitive information, data leakage, and remote code execution on the server.
To mitigate the risk, it is recommended to upgrade to the patched versions of Moodle (4.3.4, 4.2.7, or 4.1.10) and ensure proper configuration of the shared hosting environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
