CVE-2021-36396: Moodle - Blind SSRF Risk
Summary
CVE-2021-36396: In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. Affects moodle across 3 version ranges.
< 3.9.8
>= 3.10.0, < 3.10.5
>= 3.11.0, < 3.11.1
Fixed in 3.9.8, 3.10.5 or 3.11.1, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2021-36396 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a wide range of features for educators and learners, including course management, content creation, assessments, and communication tools. Moodle is widely adopted in educational institutions and organizations worldwide. However, a vulnerability has been identified in Moodle that allows for blind server-side request forgery (SSRF) attacks.
Vulnerability Detail
The vulnerability in Moodle arises from insufficient redirect handling, which enables an attacker to bypass cURL blocked hosts/allowed ports restrictions. This blind SSRF risk can be exploited to make unauthorized requests to internal resources or external systems accessible from the Moodle server. The impact of this vulnerability can vary depending on the specific configuration and network environment. However, it could potentially lead to unauthorized data access, information disclosure, or further exploitation of vulnerable systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.9.83.9.8 -
>= 3.10.0, < 3.10.53.10.5 -
>= 3.11.0, < 3.11.13.11.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, administrators can consider implementing additional network-level controls, such as firewall rules or network segmentation, to restrict access to the Moodle server and mitigate the risk of SSRF attacks. It is important to note that these measures should be implemented in conjunction with applying the official updates to fully address the vulnerability.
Conclusion
The identified vulnerability in Moodle exposes a blind SSRF risk, which can be exploited to bypass cURL blocked hosts/allowed ports restrictions. It is crucial for administrators to promptly update their Moodle installations to the recommended patched versions (3.9.8, 3.10.5, or 3.11.1) to mitigate this risk. Additionally, implementing network-level controls can provide an extra layer of protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses. It provides various features for educators and learners, facilitating course management, content creation, assessments, and communication tools.
Blind server-side request forgery (SSRF) is a vulnerability that allows an attacker to make unauthorized requests from a targeted server to internal resources or external systems accessible from the server. In this case, the SSRF risk in Moodle arises from insufficient redirect handling.
The impact of this vulnerability can vary depending on the specific configuration and network environment. However, it could potentially lead to unauthorized data access, information disclosure, or further exploitation of vulnerable systems.
To fix this vulnerability, it is recommended to update Moodle to the latest patched versions (3.9.8, 3.10.5, or 3.11.1). Administrators should follow the official Moodle documentation for upgrading their installations and ensure that the update process is performed correctly.
While there is no specific workaround mentioned for this vulnerability, administrators can consider implementing additional network-level controls, such as firewall rules or network segmentation, to restrict access to the Moodle server and mitigate the risk of SSRF attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
