Cloudanix VulnDB

CVE-2024-34002

None

CVSS

—

EPSS

0.5%

Published

May 31, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A configuration issue in Moodle could allow certain users to run unauthorized code on the server when multiple customers share the same hosting environment without proper separation.

Chainable
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Data Exposure
Component
Application
Class
Path Traversal
Remediation
Config Change
Effort
Low
Patch risk
Low

What it actually does

Allows local file inclusion through path traversal when a user with feedback module restore access directly manipulates files on the web server outside the Moodle webroot in a misconfigured shared hosting environment.

Why it matters to the business

In shared hosting setups, this can lead to unauthorized code execution, potential data exposure across tenants, and server compromise if isolation between users is not enforced.

How an attack unfolds

An attacker with feedback restore permissions and direct server access outside the Moodle root crafts a malicious restore payload that traverses paths to include and execute arbitrary local files.

How to fix it

Upgrade Moodle to the fixed commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10; enforce proper user isolation and restrict direct server access outside the webroot in shared hosting environments.

How to confirm the fix worked

Confirm the repository is at commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10; audit shared hosting configurations for cross-user access restrictions and test restore operations with path traversal attempts.

Typical attack path

  1. Obtain a Moodle account with permission to restore feedback modules
  2. Gain direct filesystem access to the web server outside the Moodle webroot via misconfigured shared hosting
  3. Prepare a feedback restore archive containing path traversal sequences to reference local files
  4. Trigger the restore operation to include and execute the targeted local file

How to detect it

Review Moodle restore logs and web server access logs for feedback module operations that reference paths outside the expected webroot or contain traversal sequences.

What your security team should do

  • Apply the fix from commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 immediately
  • Review and harden shared hosting configurations to prevent cross-user content access
  • Limit feedback module restore permissions to trusted administrators only
  • Monitor for unusual restore activity and restrict direct filesystem access outside the Moodle webroot

The record

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

Affected packages

Ecosystem Package Introduced Fixed
Packagist moodle/moodle 0 4.1.10
Packagist moodle/moodle 4.2.0 4.2.7
Packagist moodle/moodle 4.3.0 4.3.4
Bitnami moodle 0 4.1.10
Ubuntu:16.04:LTS moodle 0 No fix
Ubuntu:18.04:LTS moodle 0 No fix
Ubuntu:Pro:16.04:LTS moodle 0 No fix
Ubuntu:Pro:18.04:LTS moodle 0 No fix
packagist moodle/moodle 4.2.0 4.2.7
packagist moodle/moodle 4.3.0 4.3.4

Related vulnerabilities