Cloudanix VulnDB

CVE-2024-28593

None

CVSS

—

EPSS

0.6%

Published

Mar 22, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in a learning platform's chat feature lets users paste certain web code that can slow the system down for everyone.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper input validation in the Chat activity permits insertion of HTML A/IMG elements or other content that triggers performance degradation through excessive processing or resource consumption.

Why it matters to the business

Chat functionality can become slow or unresponsive, disrupting student communication and potentially increasing server load until mitigated; the issue affects widely deployed AlmaLinux systems with Pillow packages.

How an attack unfolds

An authenticated student crafts a message containing unsanitized HTML A or IMG elements or heavy content and posts it in the Chat activity; the lack of validation causes the platform to render or process the input, leading to measurable performance impact.

How to fix it

Upgrade python3-pillow, python3-pillow-devel, python3-pillow-doc, and python3-pillow-tk on AlmaLinux 8 to version 5.1.1-18.el8_5 or later; apply vendor patches for the Chat activity and consider disabling or removing the Chat module as indicated in vendor documentation.

How to confirm the fix worked

Confirm package versions match or exceed 5.1.1-18.el8_5 using rpm -q; test Chat input validation by attempting to post the previously allowed HTML constructs and verify they are now rejected or stripped.

Typical attack path

  1. Obtain a student-level account in Moodle
  2. Locate an active Chat activity instance
  3. Submit a message embedding an A/IMG element or performance-degrading HTML
  4. Observe or amplify the resulting slowdown across users

How to detect it

Review web server and application logs for chat message submissions containing raw A or IMG tags, unusually long HTML payloads, or patterns that previously triggered performance alerts; correlate with user activity timestamps around chat sessions.

What your security team should do

  • Apply the listed AlmaLinux package updates immediately given the 936 days since disclosure
  • Audit and restrict HTML usage in Chat activities or disable the module
  • Monitor for unusual chat message volumes or resource spikes
  • Review downstream dependents of Pillow for similar input-handling issues

The record

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's Using_Chat page says "If you know some HTML code, you can use it in your text to do things like insert images, play sounds or create different coloured and sized text." This page also says "Chat is due to be removed from standard Moodle."

Affected packages

Ecosystem Package Introduced Fixed
Packagist moodle/moodle 0 No fix
Bitnami moodle 4.3.3 4.3.4
Ubuntu:16.04:LTS moodle 0 No fix
Ubuntu:18.04:LTS moodle 0 No fix
Ubuntu:Pro:16.04:LTS moodle 0 No fix
Ubuntu:Pro:18.04:LTS moodle 0 No fix

Related vulnerabilities