MODULE CIST AS ROOTKIT IN MOODLE ENVIRONMENT

Abstract

This paper investigates the Center of Information Systems and Technologies (CIST) module, which was developed for the Distance Learning (DL) system based on the Moodle platform. The CIST module is designed for automatic data synchronization, facilitating student administration via an external API of the information systems and technologies center. Its functionality is protected by a capability granted solely to DL system managers. A thorough analysis of the CIST module's source code has been conducted, revealing a critical vulnerability – the complete absence of Cross-Site Request Forgery (CSRF) protection mechanisms. Specifically, the CIST module does not utilize Moodle's unique security token (sesskey), which is the standard defense against CSRF attacks. This omission allows any authenticated user to trigger privileged requests on behalf of a manager. As a result, an ordinary user without manager rights can lure a manager to a malicious cross-site scripting (XSS) page, which automatically sends a POST request with the required parameters to the CIST synchronization module. In this way, the module functions as a rootkit, enabling an attacker with low privileges to covertly execute privileged operations. The danger is compounded by the fact that the parameters are not properly filtered, allowing the attacker to specify arbitrary POST values, such as targeting all university faculties, which triggers synchronization without any filtering. This leads to unauthorized creation of user accounts with role assignments, arbitrary modification of cohort compositions, removal of legitimate students from groups, and potential leakage of confidential data via automated emails containing passwords. Furthermore, mass account generation can overload the DL server, constituting an additional attack vector. A practical exploitation scenario is described, in which a non-manager user creates a malicious HTML resource within the DL system using JavaScript, and through social engineering, induces a manager to follow a link to this resource, automatically sending a POST request on behalf of the manager to the information systems center. The impact of this attack vector is assessed, including data integrity violations, disruption of the educational process, and the potential use of the module as a rootkit for covertly manipulating the DL system without the knowledge of the administration. The study emphasizes the urgent necessity to implement standard DL system security measures. The results underscore the critical importance of a comprehensive security approach when developing additional modules for popular educational platforms, as even a single minor oversight can lead to serious consequences.