CVE-2024-34007

What it actually does

The MFA logout endpoint lacks a CSRF token, permitting forged cross-site requests that terminate authenticated sessions without user consent or interaction.

Why it matters to the business

Unexpected session terminations can interrupt workflows, increase support volume, and erode user trust in the platform's reliability.

How an attack unfolds

An attacker creates a malicious webpage or link embedding an unauthenticated POST to the MFA logout URL; when an authenticated user visits the attacker-controlled resource, the browser automatically includes session cookies and executes the logout.

How to fix it

Upgrade moodle/moodle to the commit 143c2cd5bef1268751d58bbfc6c66c1d93cb9797 or a later release that adds the missing CSRF token to the MFA logout flow.

How to confirm the fix worked

Inspect the MFA logout request handler for the presence of a CSRF token check; replay the endpoint from an external origin after applying the fix and confirm the request is rejected.

Typical attack path

1. Identify the unprotected MFA logout endpoint
2. Craft a cross-site request that triggers logout without a valid token
3. Host the payload on a site the victim is likely to visit
4. Lure the authenticated user to the malicious resource
5. Confirm session termination via subsequent access attempts

How to detect it

Examine web server access logs for POST requests to the MFA logout path that originate from external referrers or lack expected headers; correlate with user reports of abrupt logouts.

What your security team should do

• Apply the referenced commit or newer release across all Moodle instances
• Review web application firewall rules to block cross-origin requests to logout endpoints
• Enable logging of all MFA logout events with referrer data for anomaly detection