CVE-2023-5540: Remote code execution in the Moodle IMS content package activity
Moodle stores the table of contents of an IMS content package as a serialized value after upload. Reading it back involved no type check at all, which let teachers run their own code on the server.
1Summary
- Advisory
- MSA-23-0032
- System
- Moodle
- Component
- IMS content package (mod_imscp)
- Class
- Remote code execution (unsafe deserialization)
- Severity
- Serious
An IMS content package is an archive of learning material with a table of contents. Moodle extracts that structure on upload, stores it and reuses it for display and export.
What it expects there is a plain nested list. unserialize() accepted any value though, objects of arbitrary classes included, which made PHP object injection possible.
Reported by Vincent Schneider through the Moodle security process, published as MSA-23-0032.
2Who is affected
Editing teachers and managers who add or edit IMS content packages.
By default that covers teachers and managers, since they may add this activity type to their courses.
3Impact
Anyone allowed to upload a package could run commands with the web server's permissions this way. From then on course membership no longer matters, because the site's configuration, database and file store are directly reachable.
4Fix
- Affected versions
- 4.2.0 to 4.2.2, 4.1.0 to 4.1.5, 4.0.0 to 4.0.10, 3.11.0 to 3.11.16, 3.9.23 and earlier
- Fixed in
- 4.2.3, 4.1.6, 4.0.11, 3.11.17, 3.9.24
- Published
- 17 Oct 2023
- Fix in the source
- 3400ae6
Moodle now reads the structure with unserialize_array(), which returns arrays of simple values only and rejects objects.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.