CVE-2024-43432

What it actually does

The cURL wrapper in Moodle strips only HTTPAUTH and USERPWD headers during emulated redirects while preserving other original request headers, allowing HTTP authorization information to be forwarded to redirect target URLs.

Why it matters to the business

Organizations running Moodle risk unintended exposure of service account credentials or API tokens to external or attacker-controlled sites, increasing the chance of account compromise and downstream data access without requiring direct authentication bypass.

How an attack unfolds

An attacker configures a Moodle instance to follow a redirect chain that points to a server they control; when a request containing authorization headers is processed, the incomplete header stripping causes those credentials to be replayed to the attacker’s endpoint.

How to fix it

Upgrade moodle/moodle to commit aea9770cfc7d003a737f4899489d1e3982efe9ac; for the listed Ubuntu package, upgrade flashplugin-nonfree to 11.2.202.548ubuntu0.14.04.1. Verify the installed version matches a fixed release before re-enabling network features that use the cURL wrapper.

How to confirm the fix worked

Confirm the running Moodle codebase contains commit aea9770cfc7d003a737f4899489d1e3982efe9ac or later; test by issuing a request that triggers an emulated redirect and verify authorization headers are absent from the redirect target.

Typical attack path

1. Identify a Moodle feature that issues cURL requests with authorization headers and follows redirects
2. Supply or trigger a redirect URL pointing to an attacker-controlled host
3. Observe the request arriving at the attacker host containing the original authorization header
4. Replay captured credentials against the intended service to obtain unauthorized access

How to detect it

Inspect Moodle web server and cURL debug logs for requests containing Authorization headers directed at unexpected redirect targets; correlate with external network logs showing credential-bearing traffic leaving the Moodle host.

What your security team should do

• Apply the listed fixed commit or package version immediately given the credential-exposure nature of the flaw
• Audit all configured external services and API tokens used by Moodle to rotate any that may have been sent to unintended hosts
• Review Moodle HTTP request logs for redirect targets outside expected domains