CVE-2024-34001

What it actually does

Missing anti-CSRF token on actions in the admin preset tool allows forged requests to execute privileged operations when an authenticated administrator visits an attacker-controlled page.

Why it matters to the business

Successful exploitation can result in unauthorized modification of platform configuration and data, leading to service disruption, data integrity loss, or full compromise of the learning management system with high urgency due to the 8.4 CVSS rating and public disclosure since May 2024.

How an attack unfolds

An attacker prepares a web page or link containing a crafted request targeting the admin preset tool, then tricks a logged-in administrator into visiting it; because no token validates the request origin, the server performs the action with the administrator's privileges.

How to fix it

Upgrade moodle/moodle to commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 or later; verify the presence of CSRF tokens on all admin preset actions after patching.

How to confirm the fix worked

Confirm the patch commit is present in the deployed codebase, re-test the affected endpoints for anti-CSRF token enforcement, and review administrator activity logs for unexpected preset changes post-deployment.

Typical attack path

1. Identify the admin preset tool endpoints lacking CSRF tokens
2. Craft a malicious HTML form or link that triggers a desired preset action
3. Host the payload on an attacker-controlled site or deliver via phishing
4. Induce an authenticated administrator to visit the payload while logged in
5. Execute unauthorized administrative changes or data exfiltration

How to detect it

Monitor web server and application logs for POST or GET requests to admin preset endpoints that lack expected referrers or originate from external domains; correlate with administrator session activity for anomalies.

What your security team should do

• Apply the fixed commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 immediately given the high CVSS and public availability
• Enable additional logging of all admin preset tool actions for anomaly detection
• Conduct targeted user awareness training for administrators on phishing risks
• Review and enforce least-privilege access for administrative accounts