CVE-2024-34004

What it actually does

Path traversal in wiki module restore allows a privileged user with direct filesystem access outside the Moodle webroot to include arbitrary local files.

Why it matters to the business

In misconfigured shared hosting environments, an attacker could read sensitive files or execute code on the web server, potentially compromising multiple customer sites and leading to data breaches or service disruption.

How an attack unfolds

An attacker with wiki restore permissions crafts or uploads a malicious wiki backup containing path traversal sequences, restores it through the Moodle interface, and leverages direct web server access to trigger local file inclusion of attacker-controlled or sensitive files.

How to fix it

Upgrade Moodle to the commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 or a later patched release. Review and correct shared hosting configurations to prevent cross-user content access.

How to confirm the fix worked

Verify the installed codebase contains commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10, re-test the wiki restore functionality with traversal payloads in an isolated environment, and audit hosting isolation controls.

Typical attack path

1. Obtain a Moodle account with permission to restore wiki modules
2. Prepare a wiki backup or module payload containing directory traversal sequences
3. Restore the crafted wiki module via the Moodle interface
4. Use direct filesystem or web server access outside the Moodle root to trigger inclusion of the traversed file
5. Read sensitive data or execute included code

How to detect it

Review Moodle access and restore logs for unexpected wiki module restores, inspect web server logs for path traversal patterns during restore operations, and search filesystem for recently modified or included files outside expected Moodle directories.

What your security team should do

• Apply the patch to e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 or newer immediately
• Audit all shared hosting deployments for cross-user directory access
• Restrict wiki restore permissions to trusted administrators only
• Monitor for unusual wiki restore activity and file inclusion attempts