CVE-2023-28330: Arbitrary file read through manipulated Moodle backups
When importing old Moodle 1.9 backups, the wiki appended a file name from the archive to a server path without checking it. Files that had nothing to do with the backup could be read that way.
1Summary
- Advisory
- MSA-23-0005
- System
- Moodle
- Component
- Wiki, Moodle 1.9 backup import (mod_wiki)
- Class
- Arbitrary file read (path traversal)
- Severity
- Serious
Moodle converts 1.9 backups to the current format during restore. For a wiki, the backup names a file holding the initial page content, which Moodle loads from the unpacked archive.
Directory components in that name were not stripped. The path could lead out of the archive, and Moodle then read whatever server file it pointed to.
Reported by Vincent Schneider through the Moodle security process, published as MSA-23-0005.
2Who is affected
Teachers, managers and administrators who are allowed to restore courses or activities.
Per the advisory, teachers, managers and administrators hold the required restore permissions in the default configuration.
The person uploads the prepared backup themselves; nothing on the server has to be changed beforehand.
3Impact
The most valuable readable file is config.php, because it holds the Moodle database password. If other applications share the server, their files are readable too, as far as the web server can open them.
Where the database accepts those credentials, a teacher ends up with the full data set of the installation.
4Fix
- Affected versions
- 4.1.0 to 4.1.1, 4.0.0 to 4.0.6, 3.11.0 to 3.11.12, 3.9.19 and earlier
- Fixed in
- 4.1.2, 4.0.7, 3.11.13, 3.9.20
- Published
- 20 Mar 2023
- Fix in the source
- 493205b
Moodle now cleans the file name with clean_param() and PARAM_FILE, which removes directory components, so reads stay inside the unpacked archive.
Until the upgrade, restricting the restore permissions to trusted accounts limits the risk.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.