CVE-2024-34004: Local file inclusion via modified wiki backups in Moodle
Which parser renders a wiki page depends on its format. On restore, that format came from the backup file and became the name of the file Moodle included, without any cleaning.
1Summary
- Advisory
- MSA-24-0015
- System
- Moodle
- Component
- Wiki activity (mod_wiki)
- Class
- Local file inclusion (LFI)
- Severity
- Serious
Moodle wikis support several markup languages, among them Creole and NWiki. Each has a parser as a PHP file under mod/wiki/parser/markups, and Moodle picks the file by the page format.
A backup stores both the format of every page (contentformat) and the wiki's default format (defaultformat). After a restore, Moodle put both values into the file name unchanged.
Reported by Vincent Schneider through the Moodle security process, published as MSA-24-0015.
2Who is affected
Users allowed to restore wikis, provided they can place files outside the Moodle directory on misconfigured shared hosting.
This was only exploitable in one kind of environment: shared hosting that lets customers access each other's content. There, a person allowed to restore wikis in Moodle could turn a file from the hosting area outside Moodle into the parser.
3Impact
Included code runs inside Moodle. Whatever the application may read and write is open to it as well, up to the configuration file holding the database password.
4Fix
- Affected versions
- 4.3.0 to 4.3.3, 4.2.0 to 4.2.6, 4.1.9 and earlier
- Fixed in
- 4.3.4, 4.2.7, 4.1.10
- Published
- 13 May 2024
- Fix in the source
- d5a99b1
On restore, both format values are now cleaned to letters. The parser also checks the type it receives and only loads files that exist in the parser directory.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.