Moodle: Remote Code Execution via Calculated Questions
Attackers with the permission to create or modify questions in Moodle courses are able to craft malicious inputs for calculated questions, which can be abused to execute arbitrary commands on the underlying system.
Details
- Product: Moodle
- Affected Versions: 4.4 to 4.4.1, 4.3 to 4.3.5, 4.2 to 4.2.8, 4.1 to 4.1.11 and earlier unsupported versions
- Fixed Versions: 4.1.12, 4.2.9, 4.3.6, 4.4.2
- Vulnerability Type: Remote Code Execution
- Security Risk: high
- Vendor URL: https://moodle.org/
- Vendor Status: fixed version released
- Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2024-009
- Advisory Status: published
- CVE: CVE-2024-43425
- CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43425
Introduction
Moodle is a Learning Management System (LMS) designed to provide educators, administrators and learners with a single robust, secure and integrated system to create personalised learning environments.
(from vendor’s homepage)
More Details
Moodle allows trainers to create “calculated questions”, which offer a way to create individual numerical questions by the use of wildcards (i.e. you can use common variables names as x , y enclosed in curly braces to create the wildcards {x} and {y}) that are substituted with random values when the quiz is taken. Furthermore, they allow to specify a formula that is used to calculate the correct answer for the individual question.
It was found that the result verification is realized by passing the formula to
the php eval() function after sanitizing it for malicious inputs. However,
this sanitization is not complete, thus allowing attackers to execute arbitrary
commands.
Two different approaches were identified to circumvent the sanitization logic.
First, undefined variables are not substituted at all before being passed to the
eval() function, leaving them untouched as part of the formula. Additionally,
the sanitization checks for variable names are less strict than the implemented
checks for all other parts of the formula. This can be abused to call arbitrary
functions when using the PHP object->{"member"} syntax.
Next, the list of explicitly allowed mathematical functions can be used to construct arbitrary function names as strings using bit-wise operations, which can be called as variable functions when followed by parentheses. The only identified way to add the required parentheses is by using the built-in variable substitution, thus allowing attackers to call arbitrary functions defined in the Moodle context while passing a single numeric argument. The output of the function is revealed to attackers.
Proof of Concept
First approach:
As a trainer, open the question bank, add a new calculated question. Set the
question text to {b} and the answer formula to
(1)->{system($_GET[chr(97)])}. Set the grade to 100% for this answer.
After saving, the dataset has to be configured. To prevent the variable
{system($_GET[chr(97)])} from being substituted, the respective drop-down
list that is used to determine if the variable is a private or shared dataset
can be modified in the web browser’s inspector to the value 0 before being
submitted. Set the substitution for variable {b} to use a new private
dataset.
Go to the next page, note the error that a parameter is missing for the system
command. Supply the desired command by appending &a=[arbitrary command] to the
URL. The output of the specified system command will be included at the top
of the resulting HTTP response.
Second approach:
As a trainer, open the question bank, add a new calculated question. Set the
question text to {a} and the answer formula to {a}. Set the grade to 100%
for this answer.
Save, go to the next page and define the value range for {a} to the desired
numeric parameter passed to the function to be called.
Save the question, then edit it again. Set the answer formula to:
((acos(2) . 0+acos(2)) ^ (-4 . 6 . 0 . 0 . 0) ^ (3 . -3 . 0 . 0 . 0) ^
(0 . 9 . 0 . 0 . -8) ^ (0 . 3 . 2 . 0 . 8 . 0)){a}
The above expression evaluates to the string PRINTF and the variable
{a} will later be substituted by the number in the data set enclosed in
parentheses.
Saving the modified question will result in an error, but the question will
still be saved. Go back to the question bank and preview the question.
Note that the previously defined number is printed to the beginning of the
preview page, showing that the printf() function was indeed executed.
To demonstrate the impact of this approach, the following formula can be used instead:
((acos(2) . 0+acos(2) . 0+acos(2) . 0+acos(2) . 0+acos(2)) ^
(9 . 5 . 3 . 9 . -9 . -3 . 3 . -8 . -9) ^
(3 . 1 . 1 . 2 . 8 . 2 . 9 . 1 . 2 . 6 . -1 . 2) ^
(0 . 0 . 0 . 0 . 0 . 0 . 5 . 0 . 0 . 0 . 6 . 1 . 0) ^
(0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0)){a}
This formula evaluates to the DELETE_COURSE function, which deletes the course
with the specified ID, bypassing any permission checks.
Workaround
Patch the sanitization function qtype_calculated_find_formula_errors in
/question/type/calculated/questiontype.php to always return false if
calculated questions are not used.
Alternatively, remove the permission to create or modify questions from users who cannot be trusted to the same degree as a server administrator.
Fix
Upgrade Moodle to a version without the vulnerability.
Security Risk
Attackers who can create or modify questions in any course can execute arbitrary commands on the underlying system. Consequently, this vulnerability poses a high risk.
Timeline
- 2024-07-05 Vulnerability identified
- 2024-07-10 Customer approved disclosure to vendor
- 2024-07-12 Vendor notified
- 2024-08-10 Vendor released fixed version
- 2024-08-19 Vendor released security announcement
- 2024-08-23 Customer approved release of advisory
- 2024-08-27 Advisory published
RedTeam Pentesting GmbH
RedTeam Pentesting offers individual penetration tests performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately.
As there are only few experts in this field, RedTeam Pentesting wants to share its knowledge and enhance the public knowledge with research in security-related areas. The results are made available as public security advisories.
More information about RedTeam Pentesting can be found at: https://www.redteam-pentesting.de/
Working at RedTeam Pentesting
RedTeam Pentesting is looking for penetration testers to join our team in Aachen, Germany. If you are interested please visit: https://jobs.redteam-pentesting.de/