CVE-2024-43434

What it actually does

Missing or incorrect CSRF token validation in the bulk message sending functionality of the Feedback module's non-respondents report allows forged cross-site requests to execute message-sending actions under an authenticated user's session.

Why it matters to the business

Attackers can cause unauthorized bulk messages to be sent from users' accounts, resulting in internal spam, phishing attempts, degraded platform trust, and increased operational workload for administrators.

How an attack unfolds

An attacker crafts a malicious web page or link that, when visited by a logged-in Moodle user with appropriate permissions, automatically submits a forged request to the non-respondents report endpoint to trigger bulk message delivery without the user's knowledge or consent.

How to fix it

Upgrade moodle/moodle to the version containing commit aea9770cfc7d003a737f4899489d1e3982efe9ac. Review and restrict permissions for the Feedback module's non-respondents report where possible until the update is applied.

How to confirm the fix worked

Confirm the presence of the fixed commit aea9770cfc7d003a737f4899489d1e3982efe9ac in the codebase and verify that CSRF token checks are correctly enforced on the bulk message sending endpoint in the non-respondents report.

Typical attack path

1. Identify a Moodle instance running an affected version with the Feedback module enabled
2. Lure an authenticated user with sufficient privileges into visiting an attacker-controlled page
3. The malicious page issues a cross-site request to the vulnerable bulk-send endpoint
4. The server processes the request due to the flawed CSRF check and sends messages on the user's behalf

How to detect it

Review web server and Moodle access logs for POST requests to the non-respondents report endpoint that originate from external referrers or lack the expected Moodle session and token parameters; correlate with sudden spikes in sent messages from the Feedback module.

What your security team should do

• Apply the patch containing commit aea9770cfc7d003a737f4899489d1e3982efe9ac immediately
• Audit logs for unexpected bulk message activity in the Feedback module
• Temporarily disable or restrict access to the non-respondents report feature if patching cannot be performed promptly
• Educate users about the risks of clicking untrusted links while authenticated to Moodle