CVE-2024-34005: Local file inclusion via modified database backups in Moodle
Every field in the database activity has a type, and Moodle loads the matching field class by that name. When the type came from a backup file, it became part of the file path unchecked.
1Summary
- Advisory
- MSA-24-0016
- System
- Moodle
- Component
- Database activity (mod_data)
- Class
- Local file inclusion (LFI)
- Severity
- Serious
With the database activity, teachers build their own collections from fields such as text, date, picture or menu. The logic of a field type lives in a field.class.php file in a subdirectory named after the type.
On restore, Moodle took the type from the backup without cleaning it. As soon as Moodle later loaded the activity's fields, the type determined the path of the file to include.
Reported by Vincent Schneider through the Moodle security process, published as MSA-24-0016.
2Who is affected
Anyone allowed to restore database activities who, on misconfigured shared hosting, can also place files outside the Moodle directory.
The bar is high. Besides the permission to restore database activities, it takes direct access to the web server outside the Moodle directory, which only exists on shared hosting that wrongly gives customers access to other customers' content.
3Impact
If a foreign file is included as a field class, its code runs on the server with Moodle's permissions.
4Fix
- Affected versions
- 4.3.0 to 4.3.3, 4.2.0 to 4.2.6, 4.1.9 and earlier
- Fixed in
- 4.3.4, 4.2.7, 4.1.10
- Published
- 13 May 2024
- Fix in the source
- ffa045e
The field type is now reduced to letters, on restore and wherever Moodle loads a field class. That includes the CSV import of entries, which loads field classes too.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.