CVE-2024-33999

What it actually does

Unsanitized referrer URL passed directly to MFA flow enables open redirect to arbitrary external domains.

Why it matters to the business

Attackers can phish users or damage trust by redirecting them from the legitimate login flow to attacker-controlled sites, increasing risk of credential theft or session hijacking across the platform.

How an attack unfolds

An attacker crafts a specially formed URL that triggers the MFA requirement, embedding a malicious external domain in the referrer parameter; when the victim follows the link and completes MFA, the application redirects the browser to the attacker site without validation.

How to fix it

Upgrade Moodle to the commit 143c2cd5bef1268751d58bbfc6c66c1d93cb9797 or later release containing the referrer sanitization fix.

How to confirm the fix worked

Confirm the installed codebase contains commit 143c2cd5bef1268751d58bbfc6c66c1d93cb9797 and test that referrer values are sanitized before any redirect.

Typical attack path

1. Identify MFA-protected login endpoint
2. Craft URL with malicious referrer value
3. Deliver link via phishing or trusted channel
4. Victim authenticates and is redirected to attacker domain

How to detect it

Search authentication and web server logs for MFA referrer parameters containing external domains that do not match the expected application origin.

What your security team should do

• Apply the referenced commit or newer release immediately
• Audit recent authentication logs for unexpected external redirects
• Review all referrer-handling code for similar unsanitized flows