CVE-2021-21809
📋 TL;DR
This vulnerability allows authenticated administrators in Moodle to execute arbitrary commands on the server through the legacy spellchecker plugin. Attackers with admin privileges can exploit specially crafted HTTP requests to achieve remote code execution. Only Moodle installations with administrator accounts at risk are affected.
💻 Affected Systems
- Moodle
📦 What is this software?
Moodle by Moodle
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, lateral movement, and persistent backdoor installation
Likely Case
Administrator account takeover leading to data manipulation, user impersonation, and further system exploitation
If Mitigated
Limited impact due to strong access controls, monitoring, and network segmentation
🎯 Exploit Status
Exploit requires admin credentials but is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.10.4, 3.9.7, 3.8.10, and later
Vendor Advisory: https://moodle.org/mod/forum/discuss.php?d=423167
Restart Required: No
Instructions:
1. Backup your Moodle installation and database. 2. Download the patched version from moodle.org. 3. Replace affected files with patched versions. 4. Clear Moodle cache. 5. Verify functionality.
🔧 Temporary Workarounds
Disable Legacy Spellchecker Plugin
allDisable the vulnerable spellchecker plugin to prevent exploitation
Navigate to Site administration > Plugins > Text editors > TinyMCE HTML editor > Spell engine and set to 'Browser based' or disable spellchecking
🧯 If You Can't Patch
- Implement strict access controls and monitoring for administrator accounts
- Network segmentation to limit Moodle server access and egress traffic
🔍 How to Verify
Check if Vulnerable:
Check Moodle version via Site administration > Notifications page or version.php fileCheck Version:
grep "\$release" moodle/version.phpVerify Fix Applied:
Verify version is 3.10.4 or higher and spellchecker plugin is disabled or updated📡 Detection & Monitoring
Log Indicators:
- Unusual administrator activity, HTTP requests to spellchecker endpoints with suspicious parameters
Network Indicators:
- HTTP POST requests containing command injection patterns to spellchecker paths
SIEM Query:
source="moodle_logs" AND (url="*/lib/editor/tinymce/plugins/spellchecker/*" AND (param="cmd" OR param="command"))🔗 References
- http://packetstormsecurity.com/files/164481/Moodle-SpellChecker-Path-Authenticated-Remote-Command-Execution.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277
- http://packetstormsecurity.com/files/164481/Moodle-SpellChecker-Path-Authenticated-Remote-Command-Execution.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277
