Moodle 1.9 security holes - Help to seal them.

[tj2419]

Hi

 

It has recently come to our attention that our moodle installation is not as secure as it could be.

 

We have realised that XSS (Cross site scripting) can be run on our moodle install by typin code into the ilp text boxes and saving it. Detailed here on moodle.org

 

What i need is to know what we can do to stop it. Anyone have any good advice or easy to follow instructions on how we can disable it?

 

I also want to be able to restrict what file types the users can upload to moodle. Is there a way to just have a white list of accepted file types and block everything else?

 

Thanks

[Steve21]

Well in terms of generic security, the big one is upgrade moodle.

 

Whether you're upgrading to the latest version 2.4 now? or wanting to keep the old one upgrade to the lastest "patched" version of it. (Moodle 1.9.19+)

 

In terms of stopping it by terms of coding the link you gave above explains it pretty well, If you want full protection you need to limit/scan a lot, basically every input that's possible will need checking. Basically anytime someone inputs a value, it'll be checked for "mainly" special chars, like \<> etc, and they'll be stripped from the input, Thus making the script unusable. However, you can still get around that by using things like the ascii values for chars etc etc, depends how far you want to go into escaping special chars?

 

Steve

[tj2419]

Well in terms of generic security, the big one is upgrade moodle.

 

Whether you're upgrading to the latest version 2.4 now? or wanting to keep the old one upgrade to the lastest "patched" version of it. (Moodle 1.9.19+)

 

In terms of stopping it by terms of coding the link you gave above explains it pretty well, If you want full protection you need to limit/scan a lot, basically every input that's possible will need checking. Basically anytime someone inputs a value, it'll be checked for "mainly" special chars, like \<> etc, and they'll be stripped from the input, Thus making the script unusable. However, you can still get around that by using things like the ascii values for chars etc etc, depends how far you want to go into escaping special chars?

 

Steve

 

We are currently trailing moodle 2.3 with a view to upgrading. Testing blocks etc and producing some training docs for staff.

 

I kind of understand what the document sys but its where you make the changes and what code you need to put in that I'm a little lost with.

 

Cheers

[FN-GM]

@Steve21 2.4 isn't stable and is still in Beta

@tj2419 If you want to upgrade to 2.3 you can't do it directly from 1.9 you need to upgrade to 2.2 or 2.1 first.

 

Version 1.9 hasn't been supported for a while now, ideally you should upgrade software like this before support ends.

[kmount]

2.4 is stable (According to the moodle.org website)

 

1.9.19+ is supported for security fixes only (according to the moodle.org website).

[Steve21]

@Steve21 2.4 isn't stable and is still in Beta

@tj2419 If you want to upgrade to 2.3 you can't do it directly from 1.9 you need to upgrade to 2.2 or 2.1 first.

 

Version 1.9 hasn't been supported for a while now, ideally you should upgrade software like this before support ends.

 

Not tried it, but according to their website it is?

 

Current stable builds

Moodle 2.4+

MOODLE_24_STABLE

 

 

We are currently trailing moodle 2.3 with a view to upgrading. Testing blocks etc and producing some training docs for staff.

 

I kind of understand what the document sys but its where you make the changes and what code you need to put in that I'm a little lost with.

 

Cheers

 

Basically on every input area (Unless you're using a built-in addon etc). Example:

 

"SearchBox" I search for "AMGFormatDB" As you haven't stripped anything, your search script will either run that on a database or execute something etc.

 

You'd need to change the "SearchBox" query to do something like:

NewSTring = Strip <> out of String

Search for NewString

 

etc etc

 

THere should be builtin commands in moodle that do most of the work for you (at least in newer versions) Example here: Slashes - MoodleDocs

 

It'll cancel out any potentially "executable" stuff before it writes it to database etc.

 

But obviously this needs to be done for any potential inputs/outputs etc etc if you're doing it manually.

 

Steve

[FN-GM]

@Steve21 sorry about that. It wasn't stable 7 days ago, its only just come to stable release in the last week.