CVE-2022-35649: Moodle RCE Vulnerability via GhostScript

CVE-2022-35649 Overview

A critical remote code execution vulnerability was discovered in Moodle, the widely-used open-source learning management system. The vulnerability occurs due to improper input validation when parsing PostScript code, where an omitted execution parameter creates a security gap. This flaw specifically affects Moodle installations running GhostScript versions older than 9.50, allowing unauthenticated attackers to execute arbitrary code on vulnerable systems.

Critical Impact

Successful exploitation of this vulnerability may result in complete compromise of the vulnerable Moodle system, enabling attackers to gain full control over educational infrastructure, access sensitive student and faculty data, and potentially pivot to other systems within the network.

Affected Products

• Moodle (multiple versions)
• Fedora 35
• Fedora 36

Discovery Timeline

• 2022-07-25 - CVE-2022-35649 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-35649

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) that leads to code injection (CWE-94). The flaw exists in Moodle's handling of PostScript code processing, where security restrictions that should prevent arbitrary code execution are not properly enforced. The vulnerability is particularly dangerous because it can be exploited remotely without authentication, requiring no user interaction to trigger.

When Moodle processes certain file types that require GhostScript for rendering, the application fails to include necessary execution parameters that would restrict GhostScript's capabilities. This oversight allows attackers to craft malicious PostScript content that executes arbitrary system commands when processed by vulnerable GhostScript installations.

Root Cause

The root cause is an omitted execution parameter in Moodle's integration with GhostScript. When processing PostScript or related file formats, Moodle invokes GhostScript without proper sandboxing parameters, specifically missing the -dSAFER flag or equivalent security restrictions. GhostScript versions prior to 9.50 do not enable these restrictions by default, creating an exploitable condition when processing attacker-controlled PostScript content.

Attack Vector

The attack vector is network-based and does not require authentication or user interaction. An attacker can exploit this vulnerability by:

1. Uploading a malicious file containing crafted PostScript code to the Moodle platform through any file upload functionality
2. When Moodle attempts to process or generate previews of the uploaded file, it invokes GhostScript
3. The malicious PostScript code executes with the privileges of the web server process
4. The attacker gains remote code execution capabilities on the underlying system

The vulnerability is particularly concerning in educational environments where file uploads are common, such as assignment submissions, course materials, or profile images.

Detection Methods for CVE-2022-35649

Indicators of Compromise

• Unusual GhostScript process spawning with unexpected child processes
• Web server processes executing shell commands or creating reverse shells
• Suspicious file uploads containing PostScript headers or embedded commands
• Unexpected network connections originating from the Moodle server

Detection Strategies

• Monitor GhostScript process execution patterns and command-line arguments for missing security flags
• Implement file upload scanning to detect malicious PostScript content before processing
• Review web server logs for unusual file processing requests targeting image or document conversion
• Deploy network intrusion detection rules to identify exploitation attempts and post-exploitation activity

Monitoring Recommendations

• Enable detailed logging for file upload and processing activities within Moodle
• Configure alerts for GhostScript invocations that spawn unexpected child processes
• Monitor outbound network connections from the Moodle server for potential command-and-control traffic
• Implement file integrity monitoring on critical Moodle directories and configuration files

How to Mitigate CVE-2022-35649

Immediate Actions Required

• Upgrade GhostScript to version 9.50 or later, which includes enhanced security defaults
• Apply the latest Moodle security patches addressing MDL-75044
• Review and restrict file upload capabilities to minimize attack surface
• Implement web application firewall rules to filter potentially malicious PostScript content

Patch Information

Moodle has released patches addressing this vulnerability. The fix is tracked under Moodle Commit Reference MDL-75044. Administrators should update to the latest patched versions of their respective Moodle release branches. For Fedora users, updated packages have been announced through the Fedora Package Announcements. Additional details are available in the Moodle Forum Discussion.

Workarounds

• Upgrade GhostScript to version 9.50 or newer, which enables security restrictions by default
• Disable file processing features that invoke GhostScript until patches can be applied
• Restrict file upload types to exclude formats that require GhostScript processing (PS, EPS, PDF)
• Isolate the Moodle server from critical internal network resources to limit potential impact

# Verify GhostScript version and upgrade if necessary
gs --version
# Should output 9.50 or higher for secure default configuration

# Check if GhostScript SAFER mode is enabled by default
gs -dNODISPLAY -c '.currentpermissions pstack quit'

# Update GhostScript on Debian/Ubuntu systems
sudo apt-get update && sudo apt-get install ghostscript

# Update GhostScript on RHEL/CentOS/Fedora systems
sudo dnf update ghostscript