CVE-2024-25982

What it actually does

Missing anti-CSRF token on the language pack bulk-update endpoint permits forged requests that trigger language pack installations or updates when an authenticated administrator visits a crafted link.

Why it matters to the business

Attackers can force consumption of server resources and bandwidth through repeated language pack operations, produce minor configuration drift, and create operational noise without direct data loss or system takeover.

How an attack unfolds

An attacker crafts a URL or HTML element pointing to the language-pack update-all endpoint and delivers it via phishing, compromised site, or email; when an authenticated administrator loads the page the browser automatically submits the update request using existing session cookies, bypassing the absent token check and executing the language changes.

How to fix it

Upgrade all Moodle instances to the commit 8a38a37f1ff5075c6f46d726c1457172c2fccac3 (or later maintenance releases containing it) that restores the required token on the update-all language packs link; until patched, restrict administrative access and monitor language-pack activity.

How to confirm the fix worked

Inspect the language-pack management page source for the presence of a CSRF token parameter on the update-all link; replay the request without a valid token after the patch and confirm the server rejects it with an error or login redirect.

Typical attack path

1. Identify the unauthenticated or low-privilege language-pack update endpoint in the Moodle installation
2. Craft a malicious link or embedded request that omits or ignores the missing CSRF token
3. Deliver the link to an administrator via phishing, watering-hole, or cross-site embedding
4. Victim loads the page while authenticated, causing the browser to issue the update request
5. Server accepts and processes the forged request, installing or refreshing language packs

How to detect it

Search web-server access logs and Moodle application logs for requests to language-pack update endpoints that originate from external referrers, lack expected session tokens, or occur at unusual times; correlate with any sudden spikes in language-pack download activity.

What your security team should do

• Apply the referenced commit or newer maintenance release to all Moodle instances within the next maintenance window
• Review web and application logs for language-pack update events occurring outside scheduled maintenance
• Temporarily restrict the language-pack management capability to the smallest set of trusted administrators
• Add a SIEM rule to alert on POSTs to the language-pack endpoint that lack a valid referrer or session token