CVE-2023-5539: Remote code execution in the Moodle Lesson activity
The Lesson activity stored dependencies between lessons and answers to essay questions as serialized PHP values and read them back with unserialize() without restricting classes. Teachers could use this to start code on the server.
1Summary
- Advisory
- MSA-23-0031
- System
- Moodle
- Component
- Lesson (mod_lesson)
- Class
- Remote code execution (unsafe deserialization)
- Severity
- Serious
A lesson can be held back until another one is completed or a minimum grade has been reached. Moodle keeps those dependencies in the database in serialized form, and the answers to essay questions as well.
On reading, the stored value was allowed to contain objects of any class from the Moodle code base. Whoever controls the value decides which objects are created when the lesson opens, and with suitable classes that ends in their own code running on the server.
Reported by Vincent Schneider through the Moodle security process, published as MSA-23-0031.
2Who is affected
Editing teachers and managers who create or change lessons.
All it takes is permission to edit lessons, which teachers and managers have by default.
3Impact
A teacher who is only meant to maintain their own lesson gains access to the file system and database of the whole installation. Grades from other courses, accounts and uploaded work are then exposed.
4Fix
- Affected versions
- 4.2.0 to 4.2.2, 4.1.0 to 4.1.5, 4.0.0 to 4.0.10, 3.11.0 to 3.11.16, 3.9.23 and earlier
- Fixed in
- 4.2.3, 4.1.6, 4.0.11, 3.11.17, 3.9.24
- Published
- 17 Oct 2023
- Fix in the source
- ba974a4
The values are now read with unserialize_object(), which returns plain data objects only. Properties that may be missing are checked before use.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.