[MDL-68292] admin/modules.php exposes CSRF token (sesskey) in url - Moodle Tracker

XML

Word

Printable

Details

Type: Bug
Status: Closed
Priority: Minor
Resolution: Fixed
Affects Version/s: 3.8.2, 3.10
Fix Version/s: 3.8.6, 3.9.3
Component/s: Administration
Labels:
- CatalystIT
- ci
- partner
- release_notes
- security_benefit
- triaged

Affected Branches:
MOODLE_310_STABLE, MOODLE_38_STABLE
Fixed Branches:
MOODLE_38_STABLE, MOODLE_39_STABLE
Pull from Repository:
https://github.com/brendanheywood/moodle
Pull 3.9 Branch:
~~MDL-68292~~-admin-sesskey-MOODLE_39_STABLE
Pull 3.9 Diff URL:
https://github.com/moodle/moodle/compare/MOODLE_39_STABLE...brendanheywood:MDL-68292-admin-sesskey-MOODLE_39_STABLE
Pull Main Branch:
~~MDL-68292~~-admin-sesskey
Pull Main Diff URL:
https://github.com/moodle/moodle/compare/master...brendanheywood:MDL-68292-admin-sesskey
Difficulty:
Easy
Testing Instructions:

Hide

1) Login in as admin and visit http://moodle.local/admin/modules.php

2) Ensure you have some activities present in the site somewhere

3) Click on the number in the second column, confirm that the url you end up on does not have a sesskey in it

4) Back back, click on the hide toggle, confirm you do not end up with a url which contains the sesskey

5) Back back, click on the show toggle, confirm you do not end up with a url which contains the sesskey

6) Click on the uninstall link, confirm you do not end up with a url which contains the sesskey

Show
1) Login in as admin and visit http://moodle.local/admin/modules.php 2) Ensure you have some activities present in the site somewhere 3) Click on the number in the second column, confirm that the url you end up on does not have a sesskey in it 4) Back back, click on the hide toggle, confirm you do not end up with a url which contains the sesskey 5) Back back, click on the show toggle, confirm you do not end up with a url which contains the sesskey 6) Click on the uninstall link, confirm you do not end up with a url which contains the sesskey

Description

This page links to http GET pages which includes the sesskey but which do not need it, and which also do not redirect away so the sesskey persists in the browser url.

https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url

Visit: http://moodle.local/admin/modules.php

1) This first is the list of activities, here the sesskey is not needed at all:

http://moodle.local/course/search.php?modulelist=assign&sesskey=xxxxxxxxx

2) The second is the uninstall confirm page:

http://moodle.local/course/search.php?modulelist=assign&sesskey=xxxxxxxxx

Here also the sesskey is not needed until you confirm, and then in that case it should be a http post anyway.

3) This page also links to the same place with the same issue:

http://moodle.local/admin/plugins.php