CVE-2022-0335: Moodle CSRF Vulnerability

CVE-2022-0335 Overview

CVE-2022-0335 is a Cross-Site Request Forgery (CSRF) vulnerability in Moodle, the widely deployed open-source learning management system. The flaw affects the delete badge alignment functionality, which fails to enforce the required session token check. An attacker who tricks an authenticated Moodle user into visiting a malicious page can cause that user's browser to issue an unauthorized request that removes badge alignment data. The issue impacts Moodle versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11, and earlier unsupported releases. The weakness is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation lets a remote attacker manipulate badge alignment state on behalf of an authenticated victim, with potential impact on the integrity of Moodle data when high-privileged users are targeted.

Affected Products

Moodle 3.11 through 3.11.4
Moodle 3.10 through 3.10.8
Moodle 3.9 through 3.9.11 and earlier unsupported versions

Discovery Timeline

2022-01-25 - CVE-2022-0335 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0335

Vulnerability Analysis

The vulnerability resides in the badge alignment management workflow inside Moodle. Badge alignments link competencies or standards to issued badges. The delete badge alignment action processes a state-changing request without validating an anti-CSRF token (sesskey in Moodle terminology). Because the request is accepted based solely on the user's authenticated session cookie, any cross-origin form submission triggered while the victim is logged in succeeds.

An attacker hosts a malicious page that auto-submits a forged request to the affected Moodle endpoint. When a logged-in administrator or badge manager loads that page, their browser attaches the Moodle session cookie. The server processes the deletion as if the user initiated it. Refer to the Moodle Forum Discussion #431103 and Red Hat Bug Report #2043666 for vendor-confirmed details.

Root Cause

Moodle exposes a standardized sesskey token mechanism to protect state-changing operations. The delete badge alignment handler omits this check. Without server-side verification that the request originated from an authenticated, intentional user action, the endpoint treats any well-formed request with a valid session cookie as legitimate.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker needs to convince a logged-in Moodle user, typically one with badge-management privileges, to visit an attacker-controlled page or click a crafted link. No credentials or prior access to the Moodle instance are required. The attack succeeds silently in the background using a hidden HTML form or image tag pointing at the vulnerable badge alignment deletion URL.

No verified public proof-of-concept code is available for this CVE. See the Moodle Forum Discussion #431103 for the vendor's technical description.

Detection Methods for CVE-2022-0335

Indicators of Compromise

Unexpected deletions of badge alignment records in the Moodle database table badge_alignment.
Moodle audit log entries showing badge alignment deletions that do not correlate with administrator-confirmed actions.
HTTP POST or GET requests to badge alignment endpoints with Referer headers pointing to external, untrusted domains.

Detection Strategies

Review Moodle web server access logs for requests to badge management endpoints that include cross-origin Referer or Origin headers.
Correlate badge alignment change events in the Moodle event log with user session activity to identify unauthorized state changes.
Deploy a web application firewall rule that flags state-changing requests to Moodle missing a valid sesskey parameter.

Monitoring Recommendations

Forward Moodle application logs and web server logs to a centralized SIEM for correlation and long-term retention.
Alert on bursts of badge alignment modifications originating from a single user session within short time windows.
Monitor outbound requests from administrator workstations to identify drive-by CSRF delivery pages.

How to Mitigate CVE-2022-0335

Immediate Actions Required

Upgrade Moodle to a patched release: 3.11.5, 3.10.9, 3.9.12, or later supported version.
Audit recent badge alignment changes and restore any unauthorized deletions from backups.
Require administrators and badge managers to log out of Moodle sessions when not actively using the platform.

Patch Information

Moodle has released fixed builds for all supported branches. Apply the upgrade documented in Moodle Forum Discussion #431103. The patch adds the missing sesskey token check to the delete badge alignment handler. Distribution-level fixes are tracked in Red Hat Bug Report #2043666.

Workarounds

Restrict the badge management capability to a minimal set of trusted users until the patch is applied.
Enforce browser session isolation by requiring administrators to use a dedicated browser profile for Moodle administration.
Configure the web server to set SameSite=Strict or SameSite=Lax on Moodle session cookies to limit cross-site request inclusion.

bash

# Example: harden Moodle session cookie via config.php
$CFG->cookiesecure = true;
$CFG->cookiehttponly = true;
$CFG->cookiesamesite = 'Strict';