CVE-2024-43440

What it actually does

Path traversal flaw permits inclusion of arbitrary local files on the server during the restore of specially crafted block backup archives, bypassing intended access restrictions.

Why it matters to the business

Attackers can read sensitive configuration files, credentials, or other data stored on the Moodle server, leading to potential account compromise, data leakage, and compliance violations; the large number of Moodle installations increases overall exposure.

How an attack unfolds

An attacker prepares a malicious block backup archive containing path traversal sequences in file references, uploads it through the backup restore interface, and triggers restoration to force the application to include and expose targeted local files in the resulting page output or logs.

How to fix it

Upgrade Moodle to the version containing commit aea9770cfc7d003a737f4899489d1e3982efe9ac; apply the php5 package update 5.5.9+dfsg-1ubuntu4.13 on affected Ubuntu 14.04 systems; restrict backup restore permissions and validate backup contents before processing.

How to confirm the fix worked

Confirm the installed Moodle codebase contains commit aea9770cfc7d003a737f4899489d1e3982efe9ac; attempt a controlled restore of a non-malicious backup and verify that traversal attempts are rejected; review release notes for the fix.

Typical attack path

1. Obtain or create a Moodle account with permission to restore block backups
2. Craft a block backup archive embedding path traversal sequences targeting sensitive local files
3. Upload and initiate the restore process through the Moodle interface
4. Observe or exfiltrate file contents returned during or after restoration

How to detect it

Review web server and Moodle application logs for backup restore events involving unexpected file paths or error messages referencing local file access; examine restored block content for unusual path sequences.

What your security team should do

• Immediately upgrade all Moodle instances to the patched commit
• Audit and restrict user roles permitted to perform block backup restores
• Enable enhanced logging for backup and restore operations
• Scan existing backups and restored content for signs of prior traversal attempts