CVE-2024-34005: Moodle Authenticated LFI risk in some misconfigured shared hosting environments
Summary
CVE-2024-34005: Moodle Authenticated LFI risk in some misconfigured shared hosting environments. Affects moodle/moodle across 3 version ranges.
< 4.1.10
>= 4.2.0, < 4.2.7
>= 4.3.0, < 4.3.4
Fixed in 4.1.10, 4.2.7 or 4.3.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-34005 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage and organize course materials, assessments, and communication with students. Moodle is widely adopted and offers a range of features to support online learning. However, in certain misconfigured shared hosting environments, Moodle is vulnerable to an authenticated local file inclusion (LFI) attack.
Vulnerability Detail
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include. This vulnerability can be exploited by an authenticated user to access sensitive files on the server, potentially leading to unauthorized disclosure of information or remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10composer require moodle/moodle:4.1.10 -
>= 4.2.0, < 4.2.74.2.7composer require moodle/moodle:4.2.7 -
>= 4.3.0, < 4.3.44.3.4composer require moodle/moodle:4.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to address the misconfiguration in the shared hosting environment and apply the necessary updates to Moodle.
Conclusion
The Moodle Authenticated LFI vulnerability in misconfigured shared hosting environments can allow an authenticated user to access sensitive files and potentially execute arbitrary code. It is crucial to address the misconfiguration and update Moodle to the latest version to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management.
An authenticated LFI attack is a type of vulnerability where an authenticated user can include files from the server's file system, potentially accessing sensitive information or executing arbitrary code.
In a misconfigured shared hosting environment, a Moodle user with access to restore database activity modules and direct access to the web server outside of the Moodle webroot can exploit this vulnerability to execute a local file include.
This vulnerability can lead to unauthorized disclosure of sensitive information or remote code execution, depending on the files accessed by the attacker.
To fix this vulnerability, ensure the shared hosting environment is properly configured and update Moodle to the latest version (4.3.4, 4.2.7, or 4.1.10).
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
