CSRF Risks in Moodle due to Misuse of confirm_sesskey
Summary
CVE-2024-38276: Moodle CSRF risks due to misuse of confirm_sesskey. Affects moodle/moodle across 4 version ranges.
< 4.1.11
>= 4.2.0-beta, < 4.2.8
>= 4.3.0-beta, < 4.3.5
>= 4.4.0-beta, < 4.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-38276 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, facilitating communication between teachers and students, and tracking student progress. Moodle is written in PHP and utilizes a database to store course content, user information, and other relevant data. The CSRF vulnerability in Moodle arises from the improper implementation of the confirm_sesskey mechanism, which is used to protect against cross-site request forgery attacks.
Vulnerability Detail
The CSRF vulnerability in Moodle stems from the incorrect validation of CSRF tokens, leading to multiple CSRF risks. This vulnerability allows an attacker to trick authenticated users into performing unintended actions on their behalf. By exploiting this vulnerability, an attacker can potentially perform actions such as modifying user profiles, enrolling users in courses, or even executing arbitrary code. The severity of this vulnerability is considered moderate, with a CVSS score of 5.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.114.1.11composer require moodle/moodle:4.1.11 -
>= 4.2.0-beta, < 4.2.84.2.8composer require moodle/moodle:4.2.8 -
>= 4.3.0-beta, < 4.3.54.3.5composer require moodle/moodle:4.3.5 -
>= 4.4.0-beta, < 4.4.14.4.1composer require moodle/moodle:4.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the confirm_sesskey feature in Moodle. However, this is not recommended as it completely removes the CSRF protection mechanism and leaves the system vulnerable to other CSRF attacks. To disable confirm_sesskey, the following code can be added to the Moodle configuration file (config.php):
$CFG->usesesskey = false;
Conclusion
In conclusion, the CSRF vulnerability in Moodle due to the misuse of confirm_sesskey poses a moderate risk to the security of the system. It is crucial for Moodle administrators to promptly update their installations to the recommended versions to ensure the proper validation of CSRF tokens and protect against potential CSRF attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, facilitating communication between teachers and students, and tracking student progress.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In the context of Moodle, CSRF can allow an attacker to perform actions on behalf of an authenticated user without their consent.
The CSRF vulnerability in Moodle can lead to various risks, including unauthorized modification of user profiles, enrollment of users in courses without their knowledge, and potential execution of arbitrary code.
The severity of this vulnerability is considered moderate, with a CVSS score of 5.4.
To fix this vulnerability, it is recommended to update Moodle to the latest version available (4.4.1, 4.3.5, 4.2.8, or 4.1.11) as they include the necessary fixes to properly validate CSRF tokens and mitigate the risk of CSRF attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
