CVE-2024-43426: Moodle Arbitrary File Read Vulnerability via pdfTeX
Summary
CVE-2024-43426: Moodle has arbitrary file read risk through pdfTeX. Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0-beta, < 4.2.9
>= 4.3.0-beta, < 4.3.6
>= 4.4.0-beta, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43426 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities, including course management, user enrollment, and content delivery. However, Moodle's integration with pdfTeX, a typesetting system, has revealed a significant security vulnerability that could allow unauthorized access to sensitive files on the server.
Vulnerability Detail
A flaw was identified in pdfTeX due to insufficient sanitization in the TeX notation filter. This vulnerability allows an attacker to exploit the system and read arbitrary files from the server where pdfTeX is available, particularly on installations that include TeX Live. The potential ramifications include unauthorized access to sensitive information, which could lead to data breaches or further exploitation of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0-beta, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0-beta, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0-beta, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the pdfTeX functionality on your Moodle installation until the package is updated. This can be done by modifying the configuration settings in your Moodle admin panel to restrict access to TeX functionalities.
Conclusion
The CVE-2024-43426 vulnerability in Moodle poses a significant risk due to arbitrary file reading capabilities via pdfTeX. It is crucial for users to update their installations to the patched versions to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-43426 is a security vulnerability in Moodle that allows for arbitrary file reading through the pdfTeX integration due to insufficient input sanitization.
This vulnerability can lead to unauthorized access to sensitive files on the server, posing a risk of data breaches and exploitation.
The affected versions include all versions prior to 4.1.12, 4.2.9, 4.3.6, and 4.4.2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a monitoring tool that uses the composer.lock file to track and alert users in real-time about open-source vulnerabilities in their software.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
