CVE-2024-43440: Moodle Local File Inclusion Vulnerability in Block Backups
Summary
CVE-2024-43440: Moodle LFI vulnerability when restoring malformed block backups. Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0-beta, < 4.2.9
>= 4.3.0-beta, < 4.3.6
>= 4.4.0-beta, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43440 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities such as course management, user management, and content delivery. However, Moodle has been found to have a Local File Inclusion (LFI) vulnerability that arises when restoring malformed block backups, potentially allowing unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability identified as CVE-2024-43440 in Moodle allows for Local File Inclusion (LFI) when restoring block backups that are malformed. This flaw can be exploited by an attacker to include local files on the server, which may lead to unauthorized access to sensitive information. The issue stems from improper validation of file paths during the restoration process, making it possible for attackers to manipulate the input and access files that should be restricted. The severity of this vulnerability is rated as moderate, with a CVSS score of 7.5, indicating a significant risk to affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0-beta, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0-beta, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0-beta, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advisable to avoid restoring block backups from untrusted sources or to validate the integrity of the backups before restoration. Additionally, you can implement strict file access controls on your server to limit exposure to sensitive files.
Conclusion
The CVE-2024-43440 vulnerability in Moodle poses a moderate risk due to its potential for Local File Inclusion when restoring malformed block backups. It is crucial for users to update their installations to the latest patched versions to mitigate this risk. Implementing workarounds can provide temporary relief, but updating is the best long-term solution.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-43440 is a vulnerability in Moodle that allows Local File Inclusion (LFI) when restoring malformed block backups, potentially leading to unauthorized access to sensitive files.
If you are using Moodle versions prior to 4.1.12, 4.2.9, 4.3.6, or 4.4.2, your installation may be vulnerable. You can check your version in the Moodle admin dashboard.
If immediate updates are not possible, avoid restoring block backups from untrusted sources and implement strict file access controls on your server as a temporary measure.
Exploitation of this vulnerability could allow attackers to access sensitive files on the server, leading to data breaches and compromising the integrity of the Moodle installation.
You can find more information about CVE-2024-43440 in the official Moodle security advisories and on vulnerability databases such as NVD and GitHub.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
