CVE-2024-34003

What it actually does

The flaw permits local file inclusion via path traversal when a privileged user restores a workshop module in a misconfigured shared hosting setup that grants direct filesystem access outside the Moodle webroot.

Why it matters to the business

Organizations running Moodle on shared hosting risk unauthorized file reads or limited code execution that could expose student data, course materials, or server configuration, leading to compliance issues and operational disruption; the low EPSS and absence from KEV indicate limited active exploitation but the two-year window since publication warrants prompt patching across all instances.

How an attack unfolds

An attacker obtains a user account with workshop restore permissions and direct web-server access outside the Moodle directory; they craft or upload a workshop backup containing a malicious path reference; upon restore the application follows the path to include arbitrary local files, achieving limited read or execution under the web-server user context.

How to fix it

Upgrade all Moodle instances to the commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 or later; restrict shared-hosting filesystem permissions so Moodle users cannot access content outside their webroot; review and tighten workshop restore permissions to the minimum required roles.

How to confirm the fix worked

Confirm the installed Moodle codebase contains commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10; run a workshop restore test with a benign path-traversal payload and verify inclusion is blocked; audit hosting configuration to ensure no cross-user directory access is possible.

Typical attack path

1. Obtain Moodle account with workshop module restore capability
2. Gain direct filesystem write access outside the Moodle webroot via shared hosting misconfiguration
3. Prepare a workshop backup containing a path-traversal payload pointing to a target local file
4. Restore the workshop module through the Moodle interface
5. Trigger inclusion of the attacker-controlled path to read or execute the target file

How to detect it

Search web-server and Moodle access logs for workshop restore requests that contain path traversal sequences such as ../ or absolute paths outside the Moodle directory; review file-access logs for reads of unexpected files immediately following workshop restore operations.

What your security team should do

• Apply the fixed commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 immediately on all production and staging Moodle deployments
• Audit shared-hosting configurations to enforce strict per-user webroot isolation
• Reduce the number of accounts permitted to restore workshop modules
• Add monitoring for unusual workshop restore activity and file-inclusion attempts in web-server logs