CVE-2024-34005

What it actually does

Allows a privileged Moodle user with restore permissions and direct filesystem access outside the webroot to perform local file inclusion through path traversal in database activity module restoration under misconfigured shared hosting.

Why it matters to the business

In environments with multiple tenants sharing hosting resources, an attacker with limited Moodle access could read sensitive files from other users, leading to data exposure and potential credential theft without broad network access.

How an attack unfolds

An attacker with a Moodle account that can restore database activity modules and has direct server access outside the Moodle directory crafts a malicious restore payload that traverses paths to include arbitrary local files, bypassing normal webroot restrictions due to the shared hosting misconfiguration.

How to fix it

Upgrade Moodle to the commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 or later. Ensure shared hosting environments enforce strict isolation between user directories and restrict direct filesystem access outside the Moodle webroot.

How to confirm the fix worked

Verify the installed Moodle codebase contains commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10. Audit shared hosting configurations to confirm directory isolation and test that restore operations cannot include files outside the webroot.

Typical attack path

1. Obtain a Moodle account with database activity module restore capability
2. Gain direct filesystem access to the web server outside the Moodle webroot via the shared hosting misconfiguration
3. Prepare a crafted database activity module backup containing a path traversal payload
4. Restore the module through the Moodle interface to trigger local file inclusion
5. Read the contents of targeted files outside the intended directory

How to detect it

Review Moodle restore logs and web server access logs for restore operations involving database activity modules that reference paths outside the Moodle webroot. Look for file inclusion attempts or reads of unexpected system or user files during restore actions.

What your security team should do

• Apply the fixed commit immediately in all Moodle instances
• Review and harden shared hosting configurations to prevent cross-user directory access
• Restrict the database activity module restore capability to trusted administrators only
• Monitor for unusual restore activity and file access patterns outside the Moodle directory