CVE-2024-43432: Moodle Authorization Header Exposure During Emulated Redirects
Summary
CVE-2024-43432: Moodle authorization headers preserved between "emulated redirects". Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0, < 4.2.9
>= 4.3.0, < 4.3.6
>= 4.4.0, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43432 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities such as course management, user management, and content delivery. However, it is susceptible to vulnerabilities that can compromise user data and security, such as the recent issue where authorization headers are improperly handled during emulated redirects.
Vulnerability Detail
A flaw was found in Moodle's cURL wrapper, which is responsible for handling HTTP requests. During emulated redirects, the wrapper strips HTTPAUTH and USERPWD headers but retains other original request headers. This behavior can lead to the unintended exposure of sensitive HTTP authorization header information in requests sent to redirect URLs. As a result, attackers could exploit this flaw to gain unauthorized access to user data or perform actions on behalf of users without their consent.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the use of emulated redirects in your application until the update is applied. Review your code to ensure that sensitive information is not passed through headers during redirects.
Conclusion
The vulnerability CVE-2024-43432 in Moodle highlights the importance of proper handling of HTTP authorization headers during redirects. Users are encouraged to update their installations to the latest patched versions to mitigate risks associated with unauthorized data exposure.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-43432 is a vulnerability in Moodle that allows unauthorized exposure of HTTP authorization headers during emulated redirects.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The risks include unauthorized access to user data and actions being performed on behalf of users, potentially leading to data breaches.
Yes, patches are available in versions 4.4.2, 4.3.6, 4.2.9, and 4.1.12. It is recommended to update to one of these versions.
If you cannot update immediately, consider limiting the use of emulated redirects and review your code to prevent sensitive information from being passed in headers.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
