Multiple Vulnerabilities in Moodle

From: Bartek Nowotarski (silence10_at_wp.pl)
Date: 12/27/04

  • Next message: Mandrake Linux Security Team: "MDKSA-2004:158 - Updated samba packages fix integer overflow vulnerabilities" 
    Date: 27 Dec 2004 19:45:44 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    +------------------------------------------------------------------------------+
    | |
    | Multiple Vulnerabilities in Moodle |
    | ================================== |
    | |
    | Author: Bartek Nowotarski |
    | Published: 2004-12-27 |
    +------------------------------------------------------------------------------+

    [01] General information
    ~~~~~~~~~~~~~~~~~~~~~~~~

      ] Document author: Bartek Nowotarski (silence) [
      ] Location: Trzebinia, Poland [
      ] E-mail: silence10 wp pl [
      ] Site: silence 0 pl [

      ] Application: Moodle [
      ] Versions vulnerable: <= 1.4.2 [

    [02] Introduction
    ~~~~~~~~~~~~~~~~~

    `Moodle is a course management system (CMS) - a software package designed to
    help educators create quality online courses. Such e-learning systems are
    sometimes also called Learning Management Systems (LMS) or Virtual Learning
    Environments (VLE).` /www.moodle.org
    It has over 1000 *register* sites in 75 countries.

    Project home site: http://www.moodle.org

    [03] Vulnerabilities
    ~~~~~~~~~~~~~~~~~~~~

    Two vulnerabilities have been found in Moodle CMS:

      a) ] Type: Cross Site Scripting [
         ] File: /mod/forum/view.php [

         ] Description: [

           It is a well-known fact that all user-dependant variables should be
           checked for inaccurate values. The variable $search in view.php is
           not.

           54> $buttontext = forum_print_search_form($course, $search, true,
    > "plain");

         ] Proof of concept: [

           The following request will alert values of logged user cookies:

    > http://localhost/moodle/mod/forum/view.php?id=1&search=moodle%22%3E
    > %3Cscript%3Ealert(document.cookie)%3C/script%3E

           Where id variable should be existing course ID.

      b) ] Type: Session File Disclosure [
         ] File: file.php [

         ] Description: [

           All files containing session data are saved in `moodledata` dir, which
           should be invisible from web. But it is possible to gain access to them:

           45> $pathname = "$CFG->dataroot$pathinfo";

           $pathinfo is checked by function detect_munged_arguments() and allows
           one use of `..` to skip to parent directory. We can use it to skip to
           `moodledata` folder itself and then read files form `sess`.
           To obtain session ID we can use cross site scripting vulnerability.

         ] Proof od concept: [

           The following request will disclosure session file:

    > http://localhost/moodle/file.php?file=/1/../sessions/
    > sess_6ac3b47ee23c6aa55896f4cd68af9622

           Where:
             - `1` after "?file=/" is existing course ID,
             - `6ac3b47ee23c6aa55896f4cd68af9622` is session ID

    [04] Solution
    ~~~~~~~~~~~~~

    Session File Disclosure vulnerability is patched in version 1.4.3.
    Cross Site Scripting vulnerability will be patched probably in
    version 1.5.

    [05] Timeline
    ~~~~~~~~~~~~~

      ] 2004-12-09 [ Session File Disclosure vulnerability (b) discovered
      ] 2004-12-10 [ Cross Site Scripting vulnerability (a) discovered
      ] 2004-12-13 [ Vendor informed
      ] 2004-12-14 [ Session File Disclosure vulnerability (b) patched
      ] 2004-12-27 [ Advisory published

    [06] Credits
    ~~~~~~~~~~~~

    Vulnerabilities discovered by Bartek Nowotarski.

    --EOF--

  • Next message: Mandrake Linux Security Team: "MDKSA-2004:158 - Updated samba packages fix integer overflow vulnerabilities"
    • Quantcast