CVE-2024-38276: CSRF through misused confirm_sesskey() in Moodle

Moodle protects state-changing actions with a session key, the sesskey. There are two functions to check it: require_sesskey() stops on a missing or wrong key, confirm_sesskey() only returns true or false and leaves the decision to the caller.

In several places confirm_sesskey() stood alone on a line and its result was never used. The check ran but had no effect. Affected were the course content download, the configuration of LTI tools, the MoodleNet import and the fix for rescaled grades in the assignment activity.

Reported by Vincent Schneider through the Moodle security process, published as MSA-24-0024.

An attack needs a prepared web page and a person who opens it while logged in to Moodle. Their browser sends the session cookie along, and Moodle takes the request for their own.

What can be triggered this way depends on that person's permissions in Moodle.

Depending on the place, a third-party page could start an import from MoodleNet into a course, configure an LTI tool, start a download of course content or have an assignment's grades recalculated.

Where confirm_sesskey() used to be called without consequence, the code now uses require_sesskey() or evaluates the result. Without a valid key, Moodle stops the action.

If you maintain your own plugins, search for confirm_sesskey() calls whose return value nobody checks. The same mistake creeps back in easily when new pages are written.