Seeking revenge for a 3-2 defeat in Poland on matchday one, Villa were quick out of the traps, with Diaby scoring a fine solo goal inside four minutes.
However, Legia silenced the home crowd soon after, when Ernest Muci's stunning strike left Robin Olsen helpless in the Villa goal to level proceedings.
Legia went on to hit the crossbar early in the second half, but Moreno, making his first appearance since May, netted the all-important goal on the hour mark to clinch the three points for Villa.
Unai Emery's side needed a win of two goals or more to ensure safe passage straight into the last 16 as group winners though, so they now must take a point from their trip to Zrinjski Mostar in Bosnia-Herzegovina in two weeks' time to make sure of that.
Villa were already through to the knockouts before kickoff courtesy of AZ Alkmaar's win over Zrinjski in the earlier games, but Legia need a point against the Dutch side on matchday six to seal their place in the knockout round after defeat here.
There were chaotic scenes outside Villa Park ahead of kickoff, as Legia fans clashed with police outside, with fireworks and flares being let off as fighting ensued which left some officers injured.
That saw none of the travelling Polish contingent allowed entrance to the ground, and bizarre scenes emerged of the away fans throwing missiles aimed at the Villa fans into the stadium from outside.
There was quickly plenty of action on the pitch too, when Diaby gave Villa a fourth-minute lead, after taking on Artur Jedrzejczyk, and leaving him in knots, before firing beyond goalkeeper Kacper Tobiasz.
However, Legia looked lively for large periods, and Villa were caught out trying to pass their way up the pitch for the visitor's equaliser on 20 minutes.
Boubacar Kamara was culpable of giving possession away extremely cheaply, passing straight to Muci on the edge of the area, and after scoring twice in the reverse, the Albanian netted again, beating Olsen all ends up with a fantastic curling strike into the top corner.
Both sides had openings in the first half, but the best chances fell for Villa's stand-in striker Jhon Duran, who was twice denied by Tobiasz after being played through.
Tempers had flared outside the stadium, and they did so on the pitch too, as a scuffle between Douglas Luiz and Pawel Wszolek contributed to four yellow cards being dished out in the space of five minutes late in the first half.
With Legia knowing a win would seal a spot directly into the last 16, they had the first opportunity after the break, when Gil Dias was forced into an unconventional header from Wszolek's cross which looped over Olsen, but fortunately for the hosts, bounded off the bar.
However, after the visiting left-back was denied by the frame of the goal, Villa's left-sided defender then put the hosts back in front, as Moreno marked his return to the side with a goal.
The Spaniard ghosted in unattended and met Luiz's lofted free-kick superbly on the volley, leaving Tobiasz with no chance in the Legia goal to make it 2-1.
Wanting to keep their destiny in their own hands, Legia chased an equaliser, and pressed Villa high, with much success as Emery's side were often guilty of losing possession in dangerous areas, but Kosta Runjaic's side were unable to take advantage of more than a few promising openings.
As a 3-1 win would have sent Villa through as group winners, substitute Leon Bailey was inches away from adding a third late on, as Olsen's inch-perfect long pass sent the Jamaican through, but his effort bounced off the underside of the bar, onto the goal line, and out.
A few momentary scares followed but Villa comfortably saw out the win in stoppage time, meaning they lead the way heading into their matchday six trip to Bosnia, where Emery's men need a point to win the section.