Mooodle: mooodle: information disclosure and script execution via reflected cross-site scripting

The vulnerability is a reflected Cross-Site Scripting (XSS) flaw found in Moodle's policy tool return URL. The root cause is insufficient sanitization of URL parameters, specifically in the clean_param_value_localurl function. As shown in a recent commit [4], the check for javascript URIs was enhanced to block more variants, indicating that previous filtering could be bypassed. This aligns with the official description [1][2] which states that insufficient sanitization allows malicious script injection.

Exploitation occurs remotely by convincing a user to click a crafted link containing a malicious payload in the return URL parameter. The attacker does not require authentication to craft the link, making it a classic reflected XSS attack. When the victim clicks the link and interacts with the policy tool, the injected script executes in their browser context, as described in the security advisory [1][2].

Successful exploitation can lead to information disclosure or arbitrary client-side script execution. An attacker could potentially steal session cookies, perform actions on behalf of the victim, or deface pages within the Moodle instance. The impact is limited by the attacker's ability to craft a convincing phishing link, but the consequences could be severe if a user with administrative privileges falls for the attack [1][2].

A fix has been implemented in Moodle's development repository [4] and likely included in a subsequent release. Users are advised to update to the latest patched version. The open-source nature of Moodle [3] allows administrators to review the commit and apply it if an update is not immediately possible. Red Hat's advisory [1] also acknowledges the vulnerability.