Summary
Moodle's H5P content file handling may fail to enforce access checks, allowing unauthenticated remote users to view materials that should be restricted. Exposure may include system-context content and files associated with hidden or unavailable course modules.
Moodle's H5P content file handling may fail to enforce access checks, allowing unauthenticated remote users to view materials that should be restricted. Exposure may include system-context content and files associated with hidden or unavailable course modules.
Affected context
The issue occurs when Moodle serves H5P content files without adequately checking whether the requester is authorized to access them. Protected materials may be exposed when they are stored in the system context or associated with hidden or unavailable course modules.
The issue occurs when Moodle serves H5P content files without adequately checking whether the requester is authorized to access them. Protected materials may be exposed when they are stored in the system context or associated with hidden or unavailable course modules.
Exploit preconditions
- Attack surface: H5P content file access through Moodle
- Required access: The reported issue allows access by unauthenticated remote users
- Trigger point: A request to retrieve a restricted H5P content file
- Why exploitation is possible: Access-control checks may be insufficient or absent for the requested file or its context
- Attack surface: H5P content file access through Moodle
- Required access: The reported issue allows access by unauthenticated remote users
- Trigger point: A request to retrieve a restricted H5P content file
- Why exploitation is possible: Access-control checks may be insufficient or absent for the requested file or its context
Why this happens
The underlying flaw is an authorization failure: the application does not consistently verify that a requester is permitted to access a protected resource. This maps to CWE-862: Missing Authorization, where access to an operation or resource is not checked against the applicable permissions.
The underlying flaw is an authorization failure: the application does not consistently verify that a requester is permitted to access a protected resource. This maps to CWE-862: Missing Authorization, where access to an operation or resource is not checked against the applicable permissions.
Potential impact
- Restricted course materials could be disclosed to unauthorized users
- Content stored in the system context may be exposed
- Files associated with hidden or unavailable course modules could be viewed
- Confidentiality of educational or organizational content may be reduced
- Restricted course materials could be disclosed to unauthorized users
- Content stored in the system context may be exposed
- Files associated with hidden or unavailable course modules could be viewed
- Confidentiality of educational or organizational content may be reduced
General mitigation guidance
Mitigations generally focus on enforcing authorization at every point where protected files are requested.
Common defensive patterns include:
- Denying access by default and explicitly granting access only after authorization checks
- Applying consistent permission checks to files across system, course, and module contexts
- Deriving access decisions from the current user's permissions and the resource's visibility state
- Minimizing public exposure of stored content and limiting service privileges
- Testing authorization behavior for hidden, unavailable, and otherwise restricted resources
Mitigations generally focus on enforcing authorization at every point where protected files are requested.
Common defensive patterns include:
- Denying access by default and explicitly granting access only after authorization checks
- Applying consistent permission checks to files across system, course, and module contexts
- Deriving access decisions from the current user's permissions and the resource's visibility state
- Minimizing public exposure of stored content and limiting service privileges
- Testing authorization behavior for hidden, unavailable, and otherwise restricted resources
How teams detect issues like this
High-level detection approaches include:
- Reviewing file-serving paths for missing or inconsistent authorization checks
- Using static analysis and code review to trace resource access to permission enforcement
- Testing access policies across anonymous and authenticated user roles and varied content visibility states
- Enforcing security policies that require authorization checks before protected resources are returned
- Monitoring access logs for requests to restricted content that do not correspond to authorized users
High-level detection approaches include:
- Reviewing file-serving paths for missing or inconsistent authorization checks
- Using static analysis and code review to trace resource access to permission enforcement
- Testing access policies across anonymous and authenticated user roles and varied content visibility states
- Enforcing security policies that require authorization checks before protected resources are returned
- Monitoring access logs for requests to restricted content that do not correspond to authorized users
Sources
| Source | Link |
|---|---|
| access. | access.redhat.com/ |
| bugzilla. | bugzilla.redhat.com/ |
| github. | github.com/ |
| moodle. | moodle.org/ |
