CVE-2024-43432: Moodle cURL Wrapper HTTP Authorization Header Exposure
Summary
CVE-2024-43432: Moodle: authorization headers preserved between "emulated redirects". Affects moodle across 4 version ranges.
< 4.1.12
>= 4.2.0, < 4.2.9
>= 4.3.0, < 4.3.6
>= 4.4.0, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-43432 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various features such as course management, user management, and a wide range of plugins. However, it has been found to have a vulnerability in its cURL wrapper that can lead to unintended exposure of HTTP authorization headers during emulated redirects.
Vulnerability Detail
A flaw was identified in Moodle's cURL wrapper where it strips HTTPAUTH and USERPWD headers during emulated redirects but retains other original request headers. This behavior can lead to the unintended sending of HTTP authorization header information to redirect URLs, potentially exposing sensitive information to unauthorized parties. The vulnerability affects various versions of Moodle, making it critical for users to address it promptly.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12 -
>= 4.2.0, < 4.2.94.2.9 -
>= 4.3.0, < 4.3.64.3.6 -
>= 4.4.0, < 4.4.24.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can avoid using HTTP authorization headers in requests that may be redirected. This can be done by modifying the request logic to ensure sensitive headers are not included in requests that could lead to redirects.
Conclusion
In summary, CVE-2024-43432 presents a significant risk to Moodle users by potentially exposing sensitive HTTP authorization headers during redirects. It is crucial for users to update their installations to the latest patched versions to mitigate this vulnerability and ensure the security of their applications.
See every vulnerability recorded for moodle →
FAQ
CVE-2024-43432 is a vulnerability in Moodle's cURL wrapper that can unintentionally expose HTTP authorization headers during redirects.
You can check if your application is affected by using Vulert's playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring a signup.
The vulnerability affects Moodle versions prior to 4.1.12, 4.2.9, 4.3.6, and 4.4.2. Users should update to these versions or later.
The main risk is the unintended exposure of sensitive HTTP authorization information to unauthorized redirect URLs, which could lead to security breaches.
Yes, the permanent fix is to update to the patched versions of Moodle mentioned above. Regular updates are recommended to maintain security.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
