CVE-2025-3638: CSRF in the analysis request of the Moodle Brickfield tool
An accessibility analysis in the Brickfield tool could be requested from a third-party web page as soon as a permitted user opened that page.
1Summary
- Advisory
- MSA-25-0021
- System
- Moodle
- Component
- Brickfield accessibility toolkit (tool_brickfield)
- Class
- Cross-site request forgery (CSRF)
- Severity
- Minor
Brickfield checks course content for accessibility. Requesting an analysis only puts it in a queue; a scheduled task does the actual work later.
The call that accepts the request did not check the sesskey. Moodle therefore could not tell whether the request came from its own course menu or had been sent by another website open in the same browser.
Reported by Vincent Schneider through the Moodle security process, published as MSA-25-0021.
2Who is affected
Logged-in users allowed to request analyses in the Brickfield tool.
For anything to happen, a user with the analysis permission has to open the prepared page during a Moodle session. Whoever runs that page needs no access to the site at all.
3Impact
The result is an unplanned analysis for one course, which takes up server time the next time the scheduled tasks run. Course content and permissions are left alone.
4Fix
- Affected versions
- 4.5.0 to 4.5.3, 4.4.0 to 4.4.7, 4.3.0 to 4.3.11, 4.1.17 and earlier
- Fixed in
- 4.5.4, 4.4.8, 4.3.12, 4.1.18
- Published
- 22 Apr 2025
- Fix in the source
- 91e6ad4
Before a course analysis is queued, Moodle now calls require_sesskey(). Without the token, the request is rejected.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.