CVE-2024-43425
📋 TL;DR
This vulnerability in Moodle allows authenticated users with question editing permissions to execute arbitrary code through calculated question types. It affects Moodle installations where users can add or update questions, potentially leading to server compromise.
💻 Affected Systems
- Moodle
📦 What is this software?
Moodle by Moodle
Moodle by Moodle
Moodle by Moodle
Moodle by Moodle
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with attacker gaining shell access, data theft, and lateral movement within the network.
Likely Case
Unauthorized code execution leading to data manipulation, privilege escalation, or installation of backdoors.
If Mitigated
Limited impact if proper access controls restrict question editing to trusted administrators only.
🎯 Exploit Status
Requires authenticated access with question editing permissions. Exploitation involves crafting malicious calculated questions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Moodle security advisory for specific patched versions
Vendor Advisory: https://moodle.org/mod/forum/discuss.php?d=461193
Restart Required: No
Instructions:
1. Update Moodle to the latest patched version. 2. Apply security patches if available for your version. 3. Review and test in staging environment before production deployment.
🔧 Temporary Workarounds
Restrict Question Editing Permissions
allTemporarily remove question editing capabilities from non-administrative users
Navigate to Site administration > Users > Permissions > Define roles > Edit role capabilities > Remove 'question:add' and 'question:edit' from non-admin roles
Disable Calculated Question Type
allTemporarily disable calculated question type if not essential
Navigate to Site administration > Plugins > Question types > Calculated > Disable
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Moodle server
- Enforce principle of least privilege for all user accounts with question editing rights
🔍 How to Verify
Check if Vulnerable:
Check Moodle version and compare against patched versions in security advisoryCheck Version:
Navigate to Site administration > Notifications page in Moodle admin panelVerify Fix Applied:
Verify Moodle version is updated to patched version and test calculated question functionality📡 Detection & Monitoring
Log Indicators:
- Unusual question creation/modification patterns
- Suspicious calculated question content with code-like syntax
- Multiple failed question submission attempts
Network Indicators:
- Unusual outbound connections from Moodle server
- Unexpected process execution originating from web server
SIEM Query:
source="moodle_logs" AND (event="question_created" OR event="question_updated") AND question_type="calculated" AND user NOT IN (admin_users)