CVE-2023-6661: Remote code execution through the Moodle log
Every Moodle log entry has a field for additional data, which can be stored as a serialized PHP value. Reading that field allowed any class, and managers could use this to run code on the server.
1Summary
- Advisory
- MSA-23-0044
- System
- Moodle
- Component
- Logging (tool_log)
- Class
- Remote code execution (unsafe deserialization)
- Severity
- Serious
For each event, such as a submission or a login, the log keeps extra details. Depending on the entry they are stored as a serialized PHP value or as JSON, and Moodle detects the format when reading.
In the PHP case, unserialize() ran without a list of allowed classes. A prepared value in the log turned into objects from the Moodle code base as soon as it was read.
Reported by Vincent Schneider through the Moodle security process, published as MSA-23-0044.
2Who is affected
Accounts with the manager role.
The advisory states that only managers could exploit it in the default configuration.
Managers administer courses and accounts in Moodle, but they normally have no access to the server itself.
3Impact
The flaw turns an account on the administration interface into access to the server. Code then runs as the web server user and can read config.php, which opens up the database as well.
If a manager account is taken over, for example with a stolen password, the attacker can establish a foothold on the server that outlasts a later password change.
4Fix
- Affected versions
- 4.3.0, 4.2.0 to 4.2.3, 4.1.0 to 4.1.6, 4.0.0 to 4.0.11, 3.11.0 to 3.11.17, 3.9.24 and earlier
- Fixed in
- 4.3.1, 4.2.4, 4.1.7, 4.0.12, 3.11.18, 3.9.25
- Published
- 21 Dec 2023
- Fix in the source
- 4b5c79f
When reading the additional data, Moodle now only allows objects of type stdClass.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.