CVE-2024-25978

What it actually does

Insufficient file size checks in the unzip functionality of the file picker allow processing of arbitrarily large archives, leading to excessive resource consumption and denial of service.

Why it matters to the business

Attackers can render the learning platform unavailable, interrupting classes, user access, and administrative workflows across affected deployments.

How an attack unfolds

An attacker identifies a vulnerable Moodle instance, uploads an oversized zip file through the file picker without triggering size limits, and initiates extraction, exhausting server memory or CPU.

How to fix it

Upgrade Moodle to the version containing commit 8a38a37f1ff5075c6f46d726c1457172c2fccac3 which enforces proper file size validation before extraction.

How to confirm the fix worked

Confirm the commit is present in the deployed codebase; test by attempting to upload and extract an oversized zip and verify the operation is rejected before processing.

Typical attack path

1. Identify a publicly reachable Moodle instance exposing the file picker
2. Prepare or generate a zip archive exceeding normal size expectations
3. Upload the archive via unauthenticated or low-privilege file picker endpoints
4. Trigger the unzip operation to force resource exhaustion on the server

How to detect it

Inspect web server and application logs for unusually large file uploads to the file picker unzip path and correlate with spikes in memory or CPU usage on the host.

What your security team should do

• Apply the fixed commit or equivalent patched release without delay
• Add network-level or WAF rules to limit upload sizes to file picker endpoints
• Monitor server resource utilization for sudden spikes correlated with file uploads