CVE-2024-43427

What it actually does

Sensitive secrets and keys are not excluded from exported site administration presets, allowing them to be included in the export file.

Why it matters to the business

Organizations risk accidental exposure of credentials or keys when sharing configuration presets with external parties, potentially leading to unauthorized access or compliance issues.

How an attack unfolds

An attacker convinces an administrator to generate and share a site preset export; the exported file inadvertently contains secrets that the attacker can then extract and use.

How to fix it

Upgrade moodle/moodle to the fixed commit aea9770cfc7d003a737f4899489d1e3982efe9ac; ensure presets are reviewed before sharing.

How to confirm the fix worked

Confirm the commit aea9770cfc7d003a737f4899489d1e3982efe9ac is present in the codebase and test that new preset exports exclude secrets.

Typical attack path

1. Identify Moodle instance and persuade administrator to export site presets
2. Receive the exported preset file
3. Parse the file to extract any included secrets or keys
4. Use extracted credentials for further access or attacks

How to detect it

Review exported preset files for unexpected credential patterns; monitor for unusual sharing of preset files containing configuration data.

What your security team should do

• Apply the fix commit immediately to prevent future leaks
• Audit any previously shared presets for accidental secret exposure
• Implement policies requiring secret review before preset sharing