[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Moodle: Sensitive File Disclosure

Moodle File Disclosure Vulnerability

Systems Affected		Moodle series <1.6.9+, <1.7.7+, <1.8.9, <1.9.5
Severity				Critical
Probability of being vulnerable		Rather Low
Vendor				http://moodle.org/
Filed Bug			#MDL-18552
Author				Christian J. Eibl
Date				20090327


Moodle is an open source (webbased) learning management system with 
users all over the world in educational institutes, schools, or 
companies. See vendor homepage for details.


An input filter for TeX formulas can be exploited to disclose files 
readable by the web server. This includes the moodle configuration 
file with all authentication data and server locations for directly 
connecting to backend database.
TeX filter by default is off and in case of being activated mostly no 
complete LaTeX environment on a server system will be available.


Since Moodle 1.6 a complete LaTeX environment is preferred over the 
shipped mimetex program for rendering TeX formulas to images that can 
be included in HTML pages.

In any text input area, e.g., forum, type something like "$$ \jobname 
$$" (without quotes). If the result looks like
- "$$ \jobname $$":		TeX filter not activated
- "[jobname ?]":			TeX filter activated, but mimetex used
- "a91dbb..." (hash):		TeX filter active and LaTeX used (vuln.)

Since LaTeX per se is very powerful for file inclusion and even 
writes, the vulnerability depends on LaTeX environment and its 


If LaTeX is not configured to restrict file inclusion (default!), then 
absolute paths and relative ones can be used. As proof of concept 
"$$ \input{/etc/passwd} $$"

In case the system is vulnerable, this will read the /etc/passwd file 
and will render the contents to an image included in the text. Hence, 
content is disclosed.

Rendering takes place in temporary folder by default which should not 
be in the scope of the web server. Otherwise even arbitrary code could 
be injected to compromise the whole web environment.
By using relative paths with background knowledge of Moodle's path 
organization, it is easy to disclose the configuration file with 
sensitive data.


Several alternatives:
1) deactivate TeX filter, if not needed
2) use more restrictive mimetex program for rendering
3) change LaTeX configuration (set "openin_any=p" for paranoid!)

... or upgrade to latest development version where patch should be 
applied by now.


20090312 Bug discovered
20090313 Vendor contact / Bug filed (MDL-18552)
20090314 Response and confirmation by vendor
20090315 First patch proposed
20090327 Bug marked resolved and patch in tree