CVE-2024-34002: Local file inclusion via modified feedback backups in Moodle

A feedback activity consists of items such as multiple choice questions, text fields or info texts. The item type decides which code displays and evaluates it: Moodle looks for a directory of that name in the feedback module and loads the PHP file inside.

In a backup the type is plain text. Moodle took it over on restore without cleaning it and later, when loading the items, put it into the file path. A modified type could therefore point to a file somewhere else on the server.

Reported by Vincent Schneider through the Moodle security process, published as MSA-24-0013.

According to the advisory, two things have to come together. The person needs the permission to restore feedback activities, and must be able to place files on the same server outside the Moodle directory.

Only shared hosting where one customer account can access the content of others meets the second condition. On a dedicated server it is missing.

An included PHP file is executed inside the web server process, with everything Moodle itself may read. That includes the database credentials in config.php.

The fix works in two places. On restore and when loading, clean_param() reduces the type to letters, and feedback_get_item_class() only includes types that exist in the module. For anything else Moodle stops with an error.

If your Moodle runs at a shared hosting provider, have the separation between customer accounts checked, whether or not you have upgraded yet.