CVE-2024-45691

What it actually does

Loose string comparison in lesson activity password validation allows bypass when the configured password matches a magic hash value, causing the check to evaluate true for crafted inputs due to PHP type juggling.

Why it matters to the business

Attackers can access restricted educational content without authorization, undermining access controls on learning platforms and potentially exposing lesson materials or enabling unauthorized progression.

How an attack unfolds

An attacker targets a password-protected lesson activity whose stored password is a magic hash string; they submit a specially crafted input that loosely equals the stored value under PHP loose comparison, granting access without knowing the actual password.

How to fix it

Upgrade moodle/moodle to the fixed commit d4f5e92ee156002b95db1ab6f76e25870563e2f6 or apply the corresponding patch to enforce strict password comparison; ignore unrelated libarchive packages listed in affected products.

How to confirm the fix worked

Review source code for replacement of loose (==) comparisons with strict (===) checks in password validation functions; test by attempting access with known magic hash bypass strings after upgrade to confirm denial.

Typical attack path

1. Locate a lesson activity configured with password access restriction
2. Determine or test for a stored password matching a known magic hash format
3. Submit a crafted string input that triggers loose equality in the comparison logic
4. Gain unauthorized entry to the lesson content or activities

How to detect it

Search Moodle access logs for repeated failed or successful lesson attempts originating from the same session with unusual password values; correlate with lesson activity configuration exports to identify any magic-hash-formatted passwords still in use.

What your security team should do

• Prioritize upgrade of all Moodle instances to the patched commit within standard change windows given stable low EPSS and no KEV listing
• Audit existing lesson activities for any passwords that match documented magic hash patterns and rotate them
• Implement code review requirements for all future authentication logic changes to prevent similar comparison flaws