CVE-2026-102577

Executive Summary

CVE-2026-102577 is a Server-Side Request Forgery (SSRF) flaw in Moodle's URL downloader component, caused by incorrect handling of IPv4-mapped IPv6 addresses in the host-blocking logic. An authenticated remote user can supply a crafted URL that causes the server to issue requests to destinations the host-blocking control was intended to prohibit. Impact is limited per CVSS (4.3, C:L/I:N/A:N), but the flaw defeats a security control designed to constrain where the Moodle server can be induced to fetch content, enabling internal network probing and access to restricted endpoints from the server's network position.

Technical Analysis

The vulnerability class is CWE-918 (Server-Side Request Forgery). The NVD description states that the flaw resides in the "URL downloader's host-blocking logic" and that the root cause is "incorrect handling of IPv4-mapped IPv6 addresses." IPv4-mapped IPv6 addresses take the form ::ffff:a.b.c.d (and equivalent hexadecimal forms), representing an IPv4 address inside an IPv6 literal. A host-blocking implementation that compares or parses hostnames/addresses without normalizing IPv4-mapped IPv6 representations can conclude that a destination is permitted, while the operating system's network stack resolves and connects to the embedded IPv4 target. This is a filter/parser inconsistency: the blocklist evaluates one representation, the network layer acts on another.

The attack surface is the URL downloader — the Moodle subsystem that fetches remote resources on behalf of a user from a user-supplied URL. Because the vulnerable logic is reachable via authenticated interaction with that downloader, the CVSS vector correctly reflects PR:L (privileges required) and AV:N (network). The scope is Unchanged (S:U), meaning the vulnerable component does not, by CVSS definition, cross a trust boundary to impact other components — consistent with an SSRF that primarily yields server-originated requests rather than direct code execution.

No affected version range, patched version, commit reference, or release note was supplied in the source data. Consequently, the exact Moodle releases containing the flawed host-blocking code cannot be enumerated here, and no statement should be inferred about which branches (e.g., specific major/supported lines) are or are not impacted. The description is sufficient to characterize the vulnerability class and the specific bypass technique (IPv4-mapped IPv6) but not to identify the underlying source file, function, or configuration flag — those are not named in the provided data and must not be invented.

Exploitation Scenarios

Attack chain, inferred from the vulnerability class and the NVD description:

1. Reconnaissance / target identification. The attacker identifies a Moodle instance reachable over the network and obtains an authenticated account (the flaw requires PR:L — a low-privileged authenticated user is sufficient). The attacker confirms that the URL downloader accepts user-supplied URLs and that host-blocking restrictions are in effect (i.e., certain destinations are intended to be denied).

2. Triggering the flaw class. The attacker supplies a crafted URL that encodes a blocked destination as an IPv4-mapped IPv6 address — for example, a host expressed in the ::ffff: form rather than as a plain IPv4 literal or resolvable name. Because the host-blocking logic mishandles this representation, the address passes the block check while the server's network stack connects to the embedded IPv4 target. This is the specific bypass mechanism named in the NVD description; no additional implementation detail (function, endpoint, parameter) is provided in the source data, so none is asserted here.

3. Execution method. Request execution is the server-side fetch itself: the Moodle server issues the outbound HTTP(S) request to the restricted destination on the attacker's behalf. There is no public PoC, no Nuclei template, and no exploit code associated with this CVE in the provided data — the attack chain is inferred purely from the SSRF vulnerability class and the IPv4-mapped IPv6 bypass described by NVD.

4. Post-exploitation impact. Successful exploitation lets the attacker induce server-originated requests to destinations that were meant to be blocked: internal hosts, loopback/private address ranges, cloud metadata-style endpoints, or other services only reachable from the Moodle server's network position. CVSS subscores constrain the modeled impact to Low confidentiality (C:L), with no integrity (I:N) or availability (A:N) impact. In practice, SSRF is frequently used to enumerate internal services, retrieve unauthenticated internal resources, and gather information for follow-on attacks; per the CVSS vector, direct modification or disruption is not the assessed outcome.

Impact Assessment

CVSS 3.1 base score 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Interpretation:

• AV:N — exploitable across the network.
• AC:L — no special conditions beyond supplying the crafted URL are assessed as required.
• PR:L — requires an authenticated, low-privileged user account on the Moodle instance.
• UI:N — no victim user interaction is required; the attacker himself triggers the request.
• S:U — the vulnerable component will not, per CVSS scoping rules, cross a security boundary to affect other components.
• C:L — limited confidentiality impact (the primary modeled effect: access to otherwise-restricted resources the server can reach).
• I:N / A:N — no integrity or availability impact assessed.

Business impact centers on exploitation of the Moodle server as an internal network pivot and information-disclosure relay. The server's network position often permits access to internal management interfaces, service APIs, and metadata endpoints that external attackers cannot reach directly. The confidentiality-only, low-severity rating reflects the CVSS model but should not be read as "negligible": an SSRF that defeats a deliberate host-blocking control undermines a defense-in-depth boundary and can materially expand an attacker's reachable attack surface. Blast radius is bounded by (a) which authenticated users have access to the URL downloader functionality and (b) what the Moodle server itself can reach on the network. EPSS is not yet scored by FIRST.org; no EPSS value is asserted. CISA KEV: NO. There is no evidence of in-the-wild exploitation in the provided data.

Detection Guidance

Sigma Rule

title: Moodle SSRF via IPv4-Mapped IPv6 Host Blocking Bypass (CVE-2026-102577)
id: 9c1f7a24-5b0e-4d3a-9f21-7e6c85a1b4d0
status: experimental
description: Detects requests to Moodle downloader endpoints containing IPv4-mapped IPv6 literals (::ffff:) used to bypass host-blocking logic.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102577
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - '::ffff:'
      - '%3A%3Affff%3A'
  selection_urlparam:
    cs-uri-query|contains:
      - 'http://'
      - 'https://'
  condition: selection_uri and selection_urlparam
falsepositives:
  - Legitimate use of IPv6 literals in user-supplied URLs (rare in Moodle downloader)
level: medium
tags:
  - attack.t1190
  - cve.2026.102577

YARA Rule

rule CVE_2026_102577_Moodle_IPv4Mapped_IPv6_SSRF
{
    meta:
        description = "Detects IPv4-mapped IPv6 host literals in URL downloader request data (CVE-2026-102577)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102577"
        cve = "CVE-2026-102577"
    strings:
        $ipv4mapped1 = "::ffff:" ascii nocase
        $ipv4mapped2 = "%3A%3Affff%3A" ascii nocase
        $scheme_http = "http://" ascii nocase
        $scheme_https = "https://" ascii nocase
    condition:
        any of ($ipv4mapped*) and any of ($scheme_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102577 Moodle SSRF IPv4-mapped IPv6 host-blocking bypass attempt"; flow:established,to_server; http.uri; content:"::ffff:"; nocase; http.uri; content:"http"; nocase; threshold: type limit, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-102577; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102577; sid:2026102577; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and url.query : "*::ffff:*"]
  [network where network.protocol == "http" and url.query : "*http*" and url.query : "*::ffff:*"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval raw_q=urldecode(uri_query)
| where (match(raw_q, "(?i)::ffff:") OR match(raw_q, "(?i)%3A%3Affff%3A")) AND (match(raw_q, "(?i)http://") OR match(raw_q, "(?i)https://"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query
| where count >= 1
| sort - count

Additionally monitor outbound connections originating from the Moodle server to loopback, private (RFC1918), link-local, and multicast IPv4 ranges, which are unusual for outbound Moodle fetch traffic.

Wazuh OSSEC Rule

<group name="moodle,web,ssrf,">
  <rule id="2026102" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">::ffff:</field>
    <field name="url">http</field>
    <description>CVE-2026-102577: Possible Moodle SSRF via IPv4-mapped IPv6 host-blocking bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102577,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. No vendor fix, workaround, or affected-version range was supplied in the source data, so no specific patch reference or fixed version can be stated.

1. Immediate mitigations (compensating controls, since no patch exists):

   • Restrict or disable access to the Moodle URL downloader for untrusted/low-privileged accounts until a fix is available. The flaw requires PR:L, so reducing the population of authenticated users who can reach the downloader meaningfully reduces exposure.
   • Apply network-layer egress controls from the Moodle server: deny outbound traffic to loopback, RFC1918 private ranges, link-local (169.254.0.0/16, including cloud metadata addresses such as 169.254.169.254), and multicast destinations, except where explicitly required. Enforce this at the host firewall and, where possible, via a forward proxy that performs its own address normalization and blocklist enforcement.
   • Ensure any URL-fetching proxy can be relied upon for host validation, rather than the application layer, and configure it to reject IPv4-mapped IPv6 literals and other alternate encodings.
   • Monitor access logs for ::ffff: and URL-encoded (%3A%3Affff%3A) host literals in downloader requests, per the detection rules above.

2. Patch/upgrade steps:

   • No fixed version is available per tracked sources. Track the Moodle security advisories and changelog for the release that corrects IPv4-mapped IPv6 handling in the URL downloader's host-blocking logic, then upgrade to that version and retest the bypass.
   • Until then, do not assume the vulnerability is resolved by any interim release; validate after each update.

3. Long-term hardening:

   • Normalize all host literals before applying blocklists (canonicalize IPv4-mapped IPv6 to IPv4, resolve names, and block at the connect stage rather than the parse stage).
   • Adopt an allowlist model for outbound fetch destinations where operationally feasible.
   • Apply least privilege to the Moodle service account and segment the Moodle server from sensitive internal networks.
   • Integrate SSRF-specific test cases into secure SDLC and regression testing, with coverage for alternate IP encodings.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102577
• Moodle security advisories (vendor): https://moodle.org/security/
• CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CVSS 3.1 Specification (First.org): https://www.first.org/cvss/v3.1/specification-document

No threat actor campaigns and no exploit-in-the-wild evidence were identified in the provided data. CISA KEV: NO. Public PoC: None. Nuclei template: NO. Exploit code: NO.