CVE-2023-6663: Remote code execution through course blocks in Moodle
Moodle stores block settings as a serialized PHP value. When a course was backed up, they were read with unserialize() without restricting classes, which let teachers run code on the server.
1Summary
- Advisory
- MSA-23-0046
- System
- Moodle
- Component
- Course blocks, backup and restore (core_backup)
- Class
- Remote code execution (unsafe deserialization)
- Severity
- Serious
Blocks such as the calendar or a text block at the side of a course page keep their configuration in a single field. During backup and restore Moodle reads that field to adjust the links and file references in it to the new environment.
The backup side lacked the restriction to allowed classes. Restore already used unserialize_object() but left objects of unknown classes in the configuration.
Reported by Vincent Schneider through the Moodle security process, published as MSA-23-0046.
2Who is affected
Editing teachers and managers who manage blocks in their course.
In the default configuration teachers and managers could exploit this.
Blocks and course backup are part of Moodle core, so every installation on one of the listed versions was affected.
3Impact
The entry point is an ordinary teacher account in one course. What comes out is code on the server that reads the configuration, database password included, and so reaches the data of every course.
4Fix
- Affected versions
- 4.3.0, 4.2.0 to 4.2.3, 4.1.0 to 4.1.6, 4.0.0 to 4.0.11, 3.11.0 to 3.11.17, 3.9.24 and earlier
- Fixed in
- 4.3.1, 4.2.4, 4.1.7, 4.0.12, 3.11.18, 3.9.25
- Published
- 21 Dec 2023
- Fix in the source
- 0f3e5df
Backup now reads the block configuration with unserialize_object(). Both backup and restore also drop values whose class PHP does not know.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.