CVE-2025-34031
📋 TL;DR
A path traversal vulnerability in Moodle LMS Jmol plugin versions 6.1 and earlier allows unauthenticated attackers to read arbitrary files from the server filesystem by manipulating the query parameter in jsmol.php. This exposes sensitive configuration data including database credentials. All Moodle installations using the vulnerable Jmol plugin are affected.
💻 Affected Systems
- Moodle LMS Jmol plugin
📦 What is this software?
Jmol by Geoffrowland
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via database credential theft leading to data exfiltration, privilege escalation, or ransomware deployment.
Likely Case
Sensitive configuration file exposure including database credentials, potentially enabling further attacks.
If Mitigated
Limited to reading non-sensitive files if proper file permissions and web server configurations are in place.
🎯 Exploit Status
Exploitation evidence observed by Shadowserver Foundation on 2025-02-02. Exploit code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2 or later
Vendor Advisory: https://vulncheck.com/advisories/moodle-lms-jmol-plugin-path-traversal
Restart Required: No
Instructions:
1. Update the Jmol plugin to version 6.2 or later via Moodle plugin management. 2. Verify the update by checking plugin version in Moodle admin panel. 3. No server restart required.
🔧 Temporary Workarounds
Disable Jmol plugin
allTemporarily disable the vulnerable plugin until patching is possible
Navigate to Moodle admin panel > Plugins > Manage plugins > Disable Jmol plugin
Web server file restriction
linuxConfigure web server to block access to jsmol.php or restrict query parameter
For Apache: Add 'RewriteRule ^jsmol\.php$ - [F]' to .htaccess
For Nginx: Add 'location ~ ^/jsmol\.php$ { return 403; }' to nginx.conf
🧯 If You Can't Patch
- Implement strict web application firewall rules to block path traversal patterns in query parameters
- Restrict network access to Moodle instance to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check if Jmol plugin version is 6.1 or earlier in Moodle admin panel under Plugins > Manage pluginsCheck Version:
Check Moodle admin panel or examine plugin directory for version fileVerify Fix Applied:
Verify Jmol plugin version is 6.2 or later in Moodle admin panel and test that jsmol.php no longer accepts malicious query parameters📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs for jsmol.php
- Multiple requests to jsmol.php with ../ patterns in query parameters
- Access to sensitive files like config.php, .env, or /etc/passwd
Network Indicators:
- HTTP requests to jsmol.php containing path traversal sequences (../, ..\) in query parameters
- Unusual outbound traffic from Moodle server following exploitation
SIEM Query:
web.url:*/jsmol.php AND (web.query:*../* OR web.query:*..\*)