CVE-2024-55645: Email change confirmation token readable in Moodle
When users change their email address, Moodle sends a confirmation link to the new address. The token from that link was also stored in the user preferences, where the user could retrieve it.
1Summary
- Advisory
- MSA-24-0053
- System
- Moodle
- Component
- User profile, email change (core_user)
- Class
- Token disclosure
- Severity
- Minor
When a Moodle site requires confirmation of new email addresses, a change only takes effect once the link from an email sent to the new address has been opened. The token in that link shows that the address is reachable and belongs to the person.
The token was stored as a user preference called newemailkey. Every account can retrieve its own preferences, so the token could be obtained without access to the new address's mailbox.
Reported by Vincent Schneider through the Moodle security process, published as MSA-24-0053.
2Who is affected
Logged-in users allowed to change their own email address, on sites that require confirmation of email changes.
Only the user's own account is affected: anyone allowed to change their own email address could skip the confirmation. Sites without a confirmation step had nothing to skip.
3Impact
An account could thus be tied to an address the person does not own, for example a colleague's or another company's.
Notifications and password reset links then went to that address, and systems that match accounts by email address took over a mapping that was never verified.
4Fix
- Affected versions
- 4.5.0, 4.4.0 to 4.4.4, 4.3.0 to 4.3.8, 4.1.14 and earlier
- Fixed in
- 4.5.1, 4.4.5, 4.3.9, 4.1.15
- Published
- 17 Dec 2024
- Fix in the source
- bef4558
The token is now a private user key in its own table, created with create_user_key(). It expires after ten minutes and is checked with validate_user_key() on confirmation.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.