CVE-2021-47857: Moodle Calendar XSS Vulnerability

CVE-2021-47857 Overview

CVE-2021-47857 is a persistent cross-site scripting (XSS) vulnerability affecting Moodle 3.10.3. The vulnerability exists in the calendar event subtitle field, where insufficient input sanitization allows attackers to inject malicious JavaScript code. When other users view a crafted calendar event, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or further exploitation of the learning management system.

Critical Impact

Attackers with authenticated access can inject persistent malicious scripts that execute whenever other users view compromised calendar events, enabling session theft, phishing, and unauthorized actions on behalf of victims.

Affected Products

• Moodle 3.10.3
• Moodle versions prior to security patches addressing CWE-79

Discovery Timeline

• 2026-01-21 - CVE CVE-2021-47857 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2021-47857

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in Moodle's calendar event functionality, specifically in how the subtitle track label field processes and renders user-supplied input.

When a user creates or edits a calendar event, the subtitle field accepts input that is subsequently stored in the database without adequate sanitization. Upon retrieval and display to other users viewing the calendar, the malicious payload executes within the victim's browser session. This is a stored/persistent XSS variant, which is particularly dangerous as the malicious code persists in the application's data store and can affect multiple users over time.

The attack requires authentication (a valid Moodle account with calendar creation privileges), but once the malicious event is created, any user who views the affected calendar event becomes a potential victim.

Root Cause

The root cause is inadequate input validation and output encoding in Moodle's calendar event handling code. The subtitle track label field does not properly sanitize user input before storing it in the database, nor does it encode the output when rendering the calendar event view. This allows HTML and JavaScript content to be interpreted as executable code rather than being rendered as plain text.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access to a Moodle instance with permissions to create calendar events. The exploitation flow involves:

1. An attacker authenticates to the vulnerable Moodle instance
2. The attacker creates a new calendar event with malicious JavaScript embedded in the subtitle track label field
3. The malicious event is saved to the database
4. When other users (including administrators) view the calendar or the specific event, the injected JavaScript executes in their browser context
5. The script can perform actions such as stealing session cookies, redirecting users to phishing pages, or performing actions on behalf of the victim

The vulnerability requires user interaction (viewing the malicious calendar event) for successful exploitation. Technical details and proof-of-concept information are available through the Exploit-DB #49714 advisory.

Detection Methods for CVE-2021-47857

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in calendar event subtitle fields in the Moodle database
• Calendar events containing encoded script tags such as <script>, javascript:, or event handlers like onerror, onload
• Unexpected outbound network connections from user browsers when viewing calendar events
• Reports from users of unexpected behavior or pop-ups when accessing the calendar module

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in calendar event submissions
• Deploy content security policy (CSP) headers to prevent inline script execution and restrict script sources
• Audit Moodle database tables storing calendar event data for suspicious HTML or JavaScript content
• Monitor server logs for unusual patterns in calendar event creation or modification requests

Monitoring Recommendations

• Enable detailed logging for calendar event creation and modification actions in Moodle
• Configure SIEM alerts for detection of common XSS payload patterns in web application logs
• Implement browser-side monitoring to detect unexpected script execution or DOM manipulation
• Regularly review calendar event content for anomalous entries, particularly those with special characters or encoded content

How to Mitigate CVE-2021-47857

Immediate Actions Required

• Upgrade Moodle to the latest stable version that includes security patches for this vulnerability
• Review existing calendar events for signs of malicious content and remove any suspicious entries
• Implement Content Security Policy (CSP) headers to mitigate the impact of any successful XSS attacks
• Consider temporarily restricting calendar event creation permissions to trusted users until patching is complete

Patch Information

Administrators should update their Moodle installations to the latest patched version available from the Moodle Official Site. Consult the VulnCheck Advisory on Moodle for specific version guidance and patch details. Always test updates in a staging environment before deploying to production.

Workarounds

• Implement server-side input validation to strip or encode HTML and JavaScript from calendar event fields
• Deploy a web application firewall with XSS detection rules in front of the Moodle application
• Apply Content Security Policy headers to prevent execution of inline scripts
• Restrict calendar event creation privileges to reduce the attack surface

# Example Apache configuration to add CSP headers
# Add to your Moodle virtual host configuration
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>