CVE-2024-38275

What it actually does

The cURL wrapper retained original request headers including HTTP Authorization when automatically following HTTP redirects, causing sensitive credential information to be transmitted to the redirect target URL.

Why it matters to the business

Organizations running Moodle may have inadvertently disclosed user or service credentials to untrusted third-party sites, increasing risk of account compromise or data exposure in learning management environments.

How an attack unfolds

An attacker crafts a request that triggers a redirect to a server they control; because the wrapper forwards the original Authorization header, the attacker receives valid credentials that can be used for further unauthorized access.

How to fix it

Update moodle/moodle to the commit c8c84b4af18d50224c17a4a3193e1374fec26625 or later; verify the cURL wrapper no longer forwards Authorization headers on redirects.

How to confirm the fix worked

Review the patched code at c8c84b4af18d50224c17a4a3193e1374fec26625; test by issuing an authenticated request that receives a redirect and confirm the Authorization header is stripped on the subsequent request.

Typical attack path

1. Identify a Moodle instance performing authenticated cURL requests that follow redirects
2. Supply a URL that returns an HTTP redirect to an attacker-controlled endpoint
3. Capture the forwarded Authorization header on the attacker server
4. Replay captured credentials against Moodle or other services to obtain unauthorized access

How to detect it

Examine web server and application logs for sequences of requests where an authenticated Moodle cURL call is followed by a redirect to an external domain; look for Authorization header values appearing in unexpected destination logs.

What your security team should do

• Apply the fixed commit immediately across all Moodle instances
• Audit recent logs for any requests containing redirects that may have carried Authorization headers
• Rotate any credentials that could have been exposed through this behavior
• Implement network egress controls to limit where Moodle can send authenticated requests