CVE-2022-29585
📋 TL;DR
This vulnerability in Mahara's Isolated Institutions feature allows users to see groups from other institutions beyond the first page of group results, violating intended isolation. It affects Mahara sites using Isolated Institutions with more than ten groups. The issue is an information disclosure vulnerability.
💻 Affected Systems
- Mahara
📦 What is this software?
Mahara by Mahara
Mahara by Mahara
Mahara by Mahara
Mahara by Mahara
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users could discover and potentially access groups from other isolated institutions, leading to data leakage and privacy violations.
Likely Case
Users can see group names and potentially metadata from other institutions they shouldn't have access to, violating institutional isolation policies.
If Mitigated
With proper access controls and monitoring, the impact is limited to information disclosure of group names rather than full data access.
🎯 Exploit Status
Exploitation requires authenticated access and navigating to page 2+ of group results
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.10.5, 21.04.4, 21.10.2, or 22.04.0
Vendor Advisory: https://mahara.org/interaction/forum/topic.php?id=9093
Restart Required: No
Instructions:
1. Backup your Mahara installation and database. 2. Download the appropriate patched version from mahara.org. 3. Replace files with patched version. 4. Run any database upgrade scripts if needed.
🔧 Temporary Workarounds
Limit groups per institution
allKeep each institution's groups under 10 to prevent the pagination issue
Disable Isolated Institutions
allTurn off the Isolated Institutions feature if not required
🧯 If You Can't Patch
- Implement strict access controls and monitoring for group access patterns
- Educate users about proper data handling and report any unexpected group visibility
🔍 How to Verify
Check if Vulnerable:
Check if using Isolated Institutions with >10 groups and Mahara version is before 20.10.5, 21.04.4, 21.10.2, or 22.04.0Check Version:
Check Mahara admin panel or config.php for version informationVerify Fix Applied:
After patching, verify groups from other institutions don't appear on page 2+ of group results📡 Detection & Monitoring
Log Indicators:
- Unusual group access patterns, users accessing groups from multiple institutions
Network Indicators:
- Increased requests to group listing pages with pagination parameters
SIEM Query:
Search for GET requests to /group/* with page=2+ parameters from users accessing multiple institutions