CVE-2024-25978: Moodle DOS Vulnerability in File Picker

CVE-2024-25978 Overview

CVE-2024-25978 is a denial of service vulnerability in Moodle's file picker unzip functionality. The flaw stems from insufficient file size validation when the platform decompresses archive uploads. An unauthenticated network attacker can submit a crafted archive that expands to an excessive size, exhausting server resources. The issue is tracked under Moodle internal identifier MDL-74641 and also affects Fedora 38 packages that ship Moodle. The vulnerability maps to [CWE-400] Uncontrolled Resource Consumption and [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
Attackers can trigger resource exhaustion by uploading specially crafted archives, rendering the Moodle instance unavailable to legitimate users.

Affected Products

Moodle (multiple supported branches prior to the MDL-74641 fix)
Fedora 38 with Moodle packages
Any deployment exposing the file picker unzip functionality to untrusted users

Discovery Timeline

2024-02-19 - CVE-2024-25978 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25978

Vulnerability Analysis

The vulnerability resides in Moodle's file picker component, which permits users to upload and extract ZIP archives. The unzip routine fails to enforce adequate limits on the cumulative decompressed size of archive contents. An attacker can therefore craft an archive whose compressed footprint is small but whose decompressed output consumes disproportionate disk and memory resources. This pattern is commonly referred to as a decompression bomb or zip bomb. The result is exhaustion of server resources and denial of service for legitimate users.

Root Cause

The root cause is missing or insufficient validation of file sizes during decompression. Moodle's unzip handler did not check the projected expanded size of archive entries before writing them to disk. Without these guardrails, the extraction loop continues until storage, memory, or process limits are reached. The fix introduced under MDL-74641 adds proper size enforcement to the unzip path.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond the ability to reach the file picker. In many Moodle deployments, archive upload is exposed to enrolled users or, depending on configuration, to guest accounts. The attacker uploads a crafted archive through the file picker and invokes the unzip action. The server then consumes excessive CPU, memory, and disk while attempting to decompress the payload. The vulnerability impacts availability only — it does not affect confidentiality or integrity.

Detection Methods for CVE-2024-25978

Indicators of Compromise

Sudden disk space exhaustion on Moodle data directories following file picker activity
Web server processes consuming abnormal CPU or memory during unzip operations
HTTP requests to the file picker endpoint immediately followed by service degradation
Presence of small archive uploads that expand to gigabyte-scale temporary files

Detection Strategies

Monitor file system usage on $CFG->dataroot and alert on rapid growth tied to user upload sessions
Inspect web access logs for repeated POST requests to file picker and repository endpoints from the same account or IP
Correlate process resource spikes in PHP-FPM or Apache workers with unzip operations
Review Moodle event logs for \core\event\file_uploaded entries followed by extraction errors or timeouts

Monitoring Recommendations

Set alerts on disk utilization thresholds for the Moodle data directory and temp directories
Track per-user upload volume and decompressed output ratios to flag bomb-like compression ratios
Forward web server and PHP error logs to a centralized analytics platform for anomaly detection
Baseline normal file picker usage patterns and alert on outliers in archive size or extraction duration

How to Mitigate CVE-2024-25978

Immediate Actions Required

Apply the upstream Moodle patch associated with MDL-74641 from the official commit search
Update Fedora 38 packages using dnf update to pull the patched Moodle build
Restrict file picker and archive extraction permissions to trusted roles where feasible
Place Moodle behind a web application firewall configured to enforce upload size limits

Patch Information

Moodle addressed the issue under tracker entry MDL-74641. Patched releases are available through the Moodle Commit Search MDL-74641 and discussed in the Moodle Forum Discussion. Fedora users should consult the Fedora Package Announcement and the Red Hat Bug #2264074 entry for distribution-specific guidance.

Workarounds

Lower PHP upload_max_filesize and post_max_size values to constrain inbound archive size
Disable archive extraction in the file picker for untrusted roles until patches are applied
Enforce PHP memory_limit and execution timeouts to bound resource use during decompression
Deploy filesystem quotas on the Moodle data directory to prevent full disk exhaustion

bash

# Configuration example - constrain PHP upload and execution limits in php.ini
upload_max_filesize = 20M
post_max_size = 25M
memory_limit = 256M
max_execution_time = 30
max_input_time = 30