CVE-2021-32474
📋 TL;DR
This SQL injection vulnerability in Moodle allows attackers to execute arbitrary SQL commands via XML-RPC calls when MNet (Moodle Network) is enabled and configured. It requires either site administrator access or access to the keypair for exploitation. Moodle versions 3.5 through 3.10.3 are affected.
💻 Affected Systems
- Moodle
📦 What is this software?
Moodle by Moodle
Moodle by Moodle
Moodle by Moodle
Moodle by Moodle
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, or data destruction
Likely Case
Unauthorized data access and potential privilege escalation within the Moodle application
If Mitigated
Limited impact due to proper access controls and network segmentation
🎯 Exploit Status
Exploitation requires specific conditions: MNet enabled and attacker has admin access or keypair
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.10.4, 3.9.7, 3.8.9, 3.5.18
Vendor Advisory: https://moodle.org/mod/forum/discuss.php?d=422308
Restart Required: No
Instructions:
1. Backup your Moodle installation and database. 2. Download the patched version from moodle.org. 3. Replace affected files with patched versions. 4. Clear Moodle caches.
🔧 Temporary Workarounds
Disable MNet
allDisable Moodle Network functionality if not required
Navigate to Site administration > Plugins > Authentication > Manage authentication > Disable MNet authentication
Restrict XML-RPC Access
allLimit XML-RPC access to trusted IPs only
Configure web server (Apache/Nginx) to restrict access to XML-RPC endpoints
🧯 If You Can't Patch
- Disable MNet functionality entirely if not required
- Implement strict network segmentation and firewall rules to limit XML-RPC access
🔍 How to Verify
Check if Vulnerable:
Check Moodle version and verify MNet is enabled in Site administration > Plugins > AuthenticationCheck Version:
Check version in Moodle Site administration > General > Notifications or via CLI: php admin/cli/version.phpVerify Fix Applied:
Verify Moodle version is patched (3.10.4+, 3.9.7+, 3.8.9+, or 3.5.18+)📡 Detection & Monitoring
Log Indicators:
- Unusual XML-RPC requests
- SQL error messages in logs
- Unexpected database queries
Network Indicators:
- XML-RPC traffic to Moodle servers from unauthorized sources
SIEM Query:
source="moodle_logs" AND ("XML-RPC" OR "SQL error")