CVE-2022-35650: Moodle Path Traversal Vulnerability

CVE-2022-35650 Overview

CVE-2022-35650 is a directory traversal vulnerability discovered in Moodle, the widely-used open-source learning management system. The vulnerability occurs due to an input validation error when importing lesson questions, where insufficient path checks allow attackers to read arbitrary files from the server filesystem.

This vulnerability enables a remote attacker to perform directory traversal attacks by manipulating file path inputs during the lesson question import process. While the capability to access this feature is limited to teachers, managers, and administrators by default, a compromised or malicious privileged account could exploit this flaw to access sensitive configuration files, database credentials, or other critical system information.

Critical Impact
Authenticated users with teacher-level privileges or higher can read arbitrary files from the Moodle server, potentially exposing sensitive configuration data, credentials, and private user information.

Affected Products

Moodle (multiple versions)
Fedora 35
Fedora 36

Discovery Timeline

2022-07-25 - CVE-2022-35650 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-35650

Vulnerability Analysis

The vulnerability resides in Moodle's lesson question import functionality, which fails to properly validate and sanitize file path inputs. When users with appropriate privileges (teachers, managers, or administrators) import lesson questions, the application processes file references without adequately checking for path traversal sequences such as ../ or encoded variants.

This input validation weakness (CWE-20) combined with improper path handling (CWE-22) allows attackers to escape the intended directory structure and access files anywhere on the filesystem that the web server process has read permissions for. The attack requires network access and authenticated privileges, but no user interaction is needed once the attacker has valid credentials.

Root Cause

The root cause of CVE-2022-35650 is insufficient input validation in the lesson question import handler. The application fails to properly sanitize user-supplied file paths, allowing directory traversal sequences to bypass intended access restrictions. This represents both an improper input validation flaw (CWE-20) and a classic path traversal vulnerability (CWE-22).

Attack Vector

The attack vector is network-based, requiring an authenticated session with at least teacher-level privileges. An attacker would craft a malicious lesson question import request containing path traversal sequences designed to access files outside the intended upload directory.

The exploitation involves manipulating the file path parameter during the import process to include directory traversal characters. For example, an attacker might reference a path like ../../../../../../etc/passwd or target Moodle's own config.php file to extract database credentials and other sensitive configuration values.

Due to the authenticated nature of this vulnerability, threat actors would typically need to either compromise existing privileged accounts through phishing or credential theft, or exploit this vulnerability in conjunction with other authentication bypass flaws.

Detection Methods for CVE-2022-35650

Indicators of Compromise

Unusual file access patterns in web server logs, particularly requests attempting to access files outside the Moodle data directory
Log entries showing path traversal sequences (../, ..%2f, %2e%2e/) in lesson import-related requests
Access attempts to sensitive system files such as /etc/passwd, /etc/shadow, or Moodle's config.php
Anomalous activity from teacher or admin accounts accessing lesson import features repeatedly

Detection Strategies

Implement web application firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
Configure intrusion detection systems to alert on suspicious file path patterns in Moodle-related traffic
Enable verbose logging on the Moodle application and review logs for lesson import activity
Monitor file access events on the server for reads of sensitive configuration files by the web server process

Monitoring Recommendations

Enable audit logging for all lesson import activities within Moodle
Set up alerts for high-frequency lesson import requests from single user accounts
Monitor web server error logs for "file not found" or "permission denied" errors that may indicate traversal attempts
Implement file integrity monitoring on critical system and configuration files

How to Mitigate CVE-2022-35650

Immediate Actions Required

Update Moodle to the latest patched version immediately
Review audit logs for any suspicious lesson import activity from privileged accounts
Temporarily restrict lesson import capabilities to only essential administrative accounts
Audit all teacher, manager, and admin accounts for signs of compromise

Patch Information

Moodle has released security patches addressing this vulnerability. The fix is tracked under the identifier MDL-72029. Administrators should update to the latest supported version of Moodle that includes this patch. Detailed commit information is available through the Moodle Commit Search MDL-72029 and the official security advisory at Moodle Forum Discussion #436457.

Fedora users should apply the security updates distributed through the official package repositories.

Workarounds

If immediate patching is not possible, consider temporarily disabling the lesson import feature at the application level
Implement additional path validation at the web server or reverse proxy level to filter traversal sequences
Restrict file system permissions to limit what files the web server process can read
Use a web application firewall to block requests containing directory traversal patterns

bash

# Configuration example for Apache mod_security to block path traversal
SecRule ARGS "@contains ../" "id:1001,phase:2,deny,status:403,msg:'Path Traversal Attempt Detected'"
SecRule ARGS "@contains ..%2f" "id:1002,phase:2,deny,status:403,msg:'Encoded Path Traversal Attempt'"
SecRule ARGS "@contains %2e%2e" "id:1003,phase:2,deny,status:403,msg:'Double-encoded Path Traversal Attempt'"