CVE-2021-32476
📋 TL;DR
This vulnerability in Moodle's draft files area allows attackers to cause denial-of-service by bypassing user file upload limits. It affects Moodle installations from version 3.5 through 3.10.3, potentially disrupting e-learning platforms by exhausting server resources.
💻 Affected Systems
- Moodle
📦 What is this software?
Moodle by Moodle
Moodle by Moodle
Moodle by Moodle
Moodle by Moodle
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, preventing all users from accessing the Moodle platform.
Likely Case
Degraded performance or temporary service interruptions affecting user experience and learning activities.
If Mitigated
Minimal impact with proper monitoring and resource limits in place at the infrastructure level.
🎯 Exploit Status
Exploitation requires user-level access to upload files to draft areas, making authenticated attacks more likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Moodle 3.10.4, 3.9.7, 3.8.9, 3.5.18
Vendor Advisory: https://moodle.org/mod/forum/discuss.php?d=422310
Restart Required: No
Instructions:
1. Backup your Moodle installation and database. 2. Download the patched version from moodle.org. 3. Replace affected files with patched versions. 4. Run the upgrade process through the web interface or CLI.
🔧 Temporary Workarounds
Disable draft file uploads
allTemporarily disable the draft files functionality to prevent exploitation
Edit config.php and add: $CFG->enableportfolios = false;
Implement web application firewall rules
allAdd rate limiting and file upload size restrictions at the WAF level
Configure WAF to limit file upload requests per user session
🧯 If You Can't Patch
- Implement strict file upload limits at the web server level (e.g., nginx/apache max body size)
- Monitor server resource usage and set up alerts for abnormal file upload patterns
🔍 How to Verify
Check if Vulnerable:
Check Moodle version via Admin panel or by examining version.php file in Moodle root directoryCheck Version:
grep "\$release" /path/to/moodle/version.phpVerify Fix Applied:
Verify version is updated to 3.10.4, 3.9.7, 3.8.9, or 3.5.18 and test draft file upload functionality📡 Detection & Monitoring
Log Indicators:
- Unusually large file uploads to draft areas
- Multiple failed upload attempts from single users
- Resource exhaustion alerts in system logs
Network Indicators:
- Spike in POST requests to file upload endpoints
- Abnormal traffic patterns to /draftfile.php endpoints
SIEM Query:
source="moodle_logs" AND (event="file_upload" AND size>10000000) OR (event="resource_exhaustion")