Moodle JSON Response Vulnerability for Invalid Course IDs

A vulnerability in Moodle's router handling of course IDs has been identified. When the router receives invalid course IDs, it responds with JSON data instead of the expected 404 error. This inconsistency allows attackers to infer which course IDs are valid, potentially aiding in reconnaissance efforts. The vulnerability affects Moodle versions 5.0 through 5.0.2 and has been fixed in version 5.0.3.

Impact

Exploitation of this vulnerability could lead to user enumeration by allowing attackers to identify valid course IDs, which could be used for further reconnaissance or targeted attacks.

Reproduction

To reproduce this vulnerability, send a request to the Moodle router with a non-existent course ID. Observe that the response includes JSON data instead of a standard 404 error. This behavior can be confirmed with course IDs that are known to be invalid.

Remediation

Users can upgrade to Moodle version 5.0.3, where this vulnerability has been fixed.