Bartek Nowotarski
28/12/04, 18:25
+------------------------------------------------------------------------------+
| |
| Multiple Vulnerabilities in Moodle |
| ================================== |
| |
| Author: Bartek Nowotarski |
| Published: 2004-12-27 |
+------------------------------------------------------------------------------+
[01] General information
~~~~~~~~~~~~~~~~~~~~~~~~
] Document author: Bartek Nowotarski (silence) [
] Location: Trzebinia, Poland [
] E-mail: silence10 wp pl [
] Site: silence 0 pl [
] Application: Moodle [
] Versions vulnerable: <= 1.4.2 [
[02] Introduction
~~~~~~~~~~~~~~~~~
`Moodle is a course management system (CMS) - a software package designed to
help educators create quality online courses. Such e-learning systems are
sometimes also called Learning Management Systems (LMS) or Virtual Learning
Environments (VLE).` /www.moodle.org
It has over 1000 *register* sites in 75 countries.
Project home site: http://www.moodle.org
[03] Vulnerabilities
~~~~~~~~~~~~~~~~~~~~
Two vulnerabilities have been found in Moodle CMS:
a) ] Type: Cross Site Scripting [
] File: /mod/forum/view.php [
] Description: [
It is a well-known fact that all user-dependant variables should be
checked for inaccurate values. The variable $search in view.php is
not.
54> $buttontext = forum_print_search_form($course, $search, true,
> "plain");
] Proof of concept: [
The following request will alert values of logged user cookies:
> http://localhost/moodle/mod/forum/view.php?id=1&search=moodle%22%3E
> %3Cscript%3Ealert(document.cookie)%3C/script%3E
Where id variable should be existing course ID.
b) ] Type: Session File Disclosure [
] File: file.php [
] Description: [
All files containing session data are saved in `moodledata` dir, which
should be invisible from web. But it is possible to gain access to them:
45> $pathname = "$CFG->dataroot$pathinfo";
$pathinfo is checked by function detect_munged_arguments() and allows
one use of `..` to skip to parent directory. We can use it to skip to
`moodledata` folder itself and then read files form `sess`.
To obtain session ID we can use cross site scripting vulnerability.
] Proof od concept: [
The following request will disclosure session file:
> http://localhost/moodle/file.php?file=/1/../sessions/
> sess_6ac3b47ee23c6aa55896f4cd68af9622
Where:
- `1` after "?file=/" is existing course ID,
- `6ac3b47ee23c6aa55896f4cd68af9622` is session ID
[04] Solution
~~~~~~~~~~~~~
Session File Disclosure vulnerability is patched in version 1.4.3.
Cross Site Scripting vulnerability will be patched probably in
version 1.5.
[05] Timeline
~~~~~~~~~~~~~
] 2004-12-09 [ Session File Disclosure vulnerability (b) discovered
] 2004-12-10 [ Cross Site Scripting vulnerability (a) discovered
] 2004-12-13 [ Vendor informed
] 2004-12-14 [ Session File Disclosure vulnerability (b) patched
] 2004-12-27 [ Advisory published
[06] Credits
~~~~~~~~~~~~
Vulnerabilities discovered by Bartek Nowotarski.
--EOF--
| |
| Multiple Vulnerabilities in Moodle |
| ================================== |
| |
| Author: Bartek Nowotarski |
| Published: 2004-12-27 |
+------------------------------------------------------------------------------+
[01] General information
~~~~~~~~~~~~~~~~~~~~~~~~
] Document author: Bartek Nowotarski (silence) [
] Location: Trzebinia, Poland [
] E-mail: silence10 wp pl [
] Site: silence 0 pl [
] Application: Moodle [
] Versions vulnerable: <= 1.4.2 [
[02] Introduction
~~~~~~~~~~~~~~~~~
`Moodle is a course management system (CMS) - a software package designed to
help educators create quality online courses. Such e-learning systems are
sometimes also called Learning Management Systems (LMS) or Virtual Learning
Environments (VLE).` /www.moodle.org
It has over 1000 *register* sites in 75 countries.
Project home site: http://www.moodle.org
[03] Vulnerabilities
~~~~~~~~~~~~~~~~~~~~
Two vulnerabilities have been found in Moodle CMS:
a) ] Type: Cross Site Scripting [
] File: /mod/forum/view.php [
] Description: [
It is a well-known fact that all user-dependant variables should be
checked for inaccurate values. The variable $search in view.php is
not.
54> $buttontext = forum_print_search_form($course, $search, true,
> "plain");
] Proof of concept: [
The following request will alert values of logged user cookies:
> http://localhost/moodle/mod/forum/view.php?id=1&search=moodle%22%3E
> %3Cscript%3Ealert(document.cookie)%3C/script%3E
Where id variable should be existing course ID.
b) ] Type: Session File Disclosure [
] File: file.php [
] Description: [
All files containing session data are saved in `moodledata` dir, which
should be invisible from web. But it is possible to gain access to them:
45> $pathname = "$CFG->dataroot$pathinfo";
$pathinfo is checked by function detect_munged_arguments() and allows
one use of `..` to skip to parent directory. We can use it to skip to
`moodledata` folder itself and then read files form `sess`.
To obtain session ID we can use cross site scripting vulnerability.
] Proof od concept: [
The following request will disclosure session file:
> http://localhost/moodle/file.php?file=/1/../sessions/
> sess_6ac3b47ee23c6aa55896f4cd68af9622
Where:
- `1` after "?file=/" is existing course ID,
- `6ac3b47ee23c6aa55896f4cd68af9622` is session ID
[04] Solution
~~~~~~~~~~~~~
Session File Disclosure vulnerability is patched in version 1.4.3.
Cross Site Scripting vulnerability will be patched probably in
version 1.5.
[05] Timeline
~~~~~~~~~~~~~
] 2004-12-09 [ Session File Disclosure vulnerability (b) discovered
] 2004-12-10 [ Cross Site Scripting vulnerability (a) discovered
] 2004-12-13 [ Vendor informed
] 2004-12-14 [ Session File Disclosure vulnerability (b) patched
] 2004-12-27 [ Advisory published
[06] Credits
~~~~~~~~~~~~
Vulnerabilities discovered by Bartek Nowotarski.
--EOF--