Blogroll: Drupal Contrib Security

I read blogs, as well as write one. The 'blogroll' on this site reproduces some posts from some of the people I enjoy reading. There are currently 16 posts from the blog 'Drupal Contrib Security.'

Disclaimer: Reproducing an article here need not necessarily imply agreement or endorsement!

Subscribe to Drupal Contrib Security feed
Updated: 4 hours 59 min ago

Loft Data Grids - Moderately critical - XML External Entity (XXE) Processing - SA-CONTRIB-2021-043

Wed, 13/10/2021 - 17:32
Project: Loft Data GridsDate: 2021-October-13Security risk: Moderately critical 11∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Proof/TD:UncommonVulnerability:  XML External Entity (XXE) ProcessingDescription: 

This module enables aklump/loft_data_grids to be used as a Drupal module.

Excel support was provided by https://packagist.org/packages/phpoffice/phpexcel, which is abandoned and there are known security vulnerabilities: [CVE-2018-19277]: PHPOffice/PhpSpreadsheet#771. Excel support has since been replaced with the newer https://github.com/PHPOffice/PhpSpreadsheet library.

This module provides an API and This vulnerability is not exploitable in the module itself. This vulnerability only exists if custom code or another module uses the API of this module to read a spreadsheet.

Solution: 

Upgraded to the the latest version.

Reported By: Fixed By: Coordinated By: 
Categories: Technology

Linkit - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-042

Wed, 29/09/2021 - 15:38
Project: LinkitDate: 2021-September-29Security risk: Moderately critical 12∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescription: 

Linkit provides an easy interface for internal and external linking with WYSIWYG editors by using an autocomplete field.

It does not sufficiently sanitize user input.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create or edit an entity bundle.

Solution: 

Install the latest version:

  • If you use the Linkit module for Drupal 8.x, upgrade to Linkit 8.x-4.4
Reported By: Fixed By: Coordinated By: 
Categories: Technology

The Better Mega Menu - Moderately critical - Access bypass - SA-CONTRIB-2021-041

Wed, 22/09/2021 - 18:26
Project: The Better Mega MenuDate: 2021-September-22Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:DefaultVulnerability: Access bypassDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

This module has a vulnerability whereby users can select blocks as a menu item they don't have permission to view.

The vulnerability is mitigated by the fact that it can only be exploited by an attacker with the "Administer TB Mega Menu" permission.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

The Better Mega Menu - Critical - Cross Site Request Forgery - SA-CONTRIB-2021-040

Wed, 22/09/2021 - 18:26
Project: The Better Mega MenuDate: 2021-September-22Security risk: Critical 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

The module does not use CSRF tokens to protect routes for saving menu configurations.

This vulnerability can be exploited by an anonymous user.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

The Better Mega Menu - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-039

Wed, 22/09/2021 - 18:26
Project: The Better Mega MenuDate: 2021-September-22Security risk: Moderately critical 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

It does not sufficiently sanitize user input such that an admin with permissions to edit a menu may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities.

This vulnerability is mitigated by the fact that an attacker must have permission to administer mega menus and/or create or edit menu links, to inject the XSS.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

The Better Mega Menu - Moderately critical - Cross Site Scripting, Information Disclosure, Multiple vulnerabilities - SA-CONTRIB-2021-038

Wed, 22/09/2021 - 18:25
Project: The Better Mega MenuDate: 2021-September-22Security risk: Moderately critical 12∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Information Disclosure, Multiple vulnerabilitiesDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

The module does not sanitize values for CSS properties that are added by admins and rendered on the front-end, allowing attackers to inject malicious code into the front-end markup.

This vulnerability is mitigated by the fact that it can only be exploited by an attacker with permissions to administer TB Mega Menu, or a sophisticated anonymous user using a site-specific attack that exploits the Cross Site Request Forgery vulnerability that is fixed by this same release.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

Domain Group - Critical - Access bypass - SA-CONTRIB-2021-037

Wed, 22/09/2021 - 18:17
Project: Domain GroupDate: 2021-September-22Security risk: Critical 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This module enables sites to define a domain from Domain Access that points directly to a group page.

The module doesn't sufficiently manage the access to content administrative paths allowing an attacker to see and take actions on content (nodes) they should be allowed to.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider - Moderately critical - Multiple vulnerabilities - SA-CONTRIB-2021-036

Wed, 22/09/2021 - 18:12
Project: SAML SP 2.0 Single Sign On (SSO) - SAML Service ProviderDate: 2021-September-22Security risk: Moderately critical 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Multiple vulnerabilitiesDescription: 

This module provides a solution to authenticate visitors using existing SAML providers.

Certain non-default configurations allow a malicious user to login as any chosen user.

The vulnerability is mitigated by the module's default settings which require the options "Either sign SAML assertions" and "x509 certificate".

Solution: 

Ensure that the "Either SAML response or SAML assertion must be signed" and "x509 certificate" options on the dedicated plugin page are both enabled.

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

Taxonomy Manager - Moderately critical - Access bypass - SA-CONTRIB-2021-035

Wed, 22/09/2021 - 18:09
Project: Taxonomy ManagerDate: 2021-September-22Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

This module provides a powerful interface for managing a taxonomy vocabulary. A vocabulary gets displayed in a dynamic tree view, where parent terms can be expanded to list their nested child terms or can be collapsed.

The module does not take the correct user permissions into account, allowing an attacker to delete and move terms.

The issue is mitigated by the fact that an attacker must have permission to create terms in the targeted vocabulary.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

Search API attachments - Critical - Arbitrary PHP code execution - SA-CONTRIB-2021-034

Wed, 22/09/2021 - 17:58
Project: Search API attachmentsDate: 2021-September-22Security risk: Critical 15∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Arbitrary PHP code executionDescription: 

This module enables you to extract the textual content of files for use on a website, e.g. to display it or or use it in search indexes.

The module doesn't sufficiently protect the administrator-defined commands which are executed on the server, which leads to post-authentication remote code execution by a limited set of users.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer search_api". Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission.

Solution: 

Install the latest version:

The 8.x branch does not have Security Coverage.

Reported By: Fixed By: Coordinated By: 
Categories: Technology

File Extractor - Critical - Arbitrary PHP code execution - SA-CONTRIB-2021-033

Wed, 22/09/2021 - 17:55
Project: File ExtractorDate: 2021-September-22Security risk: Critical 15∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Arbitrary PHP code executionDescription: 

This module enables you to extract the textual content of files for use on a website, e.g. to display it or or use it in search indexes.

The module doesn't sufficiently protect the administrator-defined commands which are executed on the server, which leads to post-authentication remote code execution by a limited set of users.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer File Extractor" to access the settings form. Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

Commerce Core - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2021-032

Wed, 22/09/2021 - 17:51
Project: Commerce CoreDate: 2021-September-22Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypass, Information DisclosureDescription: 

This module provides a system for building an ecommerce solution in their Drupal site.

The module doesn't sufficiently verify access to profile data in certain circumstances.

This vulnerability is mitigated by the fact that an attacker must have permission to perform the checkout operation.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

Client-side Hierarchical Select - Moderately critical - Cross-site scripting - SA-CONTRIB-2021-031

Wed, 22/09/2021 - 17:49
Project: Client-side Hierarchical SelectDate: 2021-September-22Security risk: Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingDescription: 

The module provides a field widget for selecting taxonomy terms in a hierarchical fashion.

The module doesn't sanitize user input in certain cases, leading to a possible Cross-Site-Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit taxonomy terms to which the widget may apply.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

User hash - Moderately critical - Cache poisoning - SA-CONTRIB-2021-030

Wed, 22/09/2021 - 17:43
Project: User hashDate: 2021-September-22Security risk: Moderately critical 12∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Cache poisoningDescription: 

This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters.

The module doesn't sufficiently invalidate page output when the page_cache module is used.

This vulnerability is mitigated by the fact that an attacker must have a user hash that grants access to specific content and the attack must be timed to the reset of the page cache.

Solution: 

Install the latest version:

  • If you use the user_hash module for Drupal 8 or 9, upgrade to User Hash 2.0.1
Reported By: Fixed By: Coordinated By: 
Categories: Technology

GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029

Wed, 15/09/2021 - 16:30
Project: GraphQLDate: 2021-September-15Security risk: Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassCVE IDs: CVE-2020-13675Description: 

This advisory addresses a similar issue to Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008.

The GraphQL module allows file uploads through its HTTP API. The module does not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

This vulnerability is mitigated by four factors:

  1. The GraphQL module must be enabled on the site.
  2. The GraphQL schema must expose a file upload by using the helper "src/GraphQL/Utility/FileUpload.php" in the module.
  3. An attacker must have access to that file upload via the GraphQL API.
  4. The site must employ a file validation module.
Solution: 

Install the latest version:

  • If you use the GraphQL module 8.x-4.x for Drupal 8.x or 9.x, upgrade to GraphQL 8.x-4.2
  • If you use the GraphQL module 8.x-3.x for Drupal 8.x no action is needed as a result of this advisory as the 8.x-3.x branch is not affected by this issue.
Reported By: Fixed By: Coordinated By: 
  • xjm of the Drupal Security Team
  • Drew Webber of the Drupal Security Team
Categories: Technology

Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028

Wed, 15/09/2021 - 16:28
Project: Entity EmbedDate: 2021-September-15Security risk: Moderately critical 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13673Description: 

This advisory addresses a similar issue to Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006.

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

Solution: 

Install the latest version:

Drupal 7 versions of Entity Embed do not have a stable release and therefore do not receive security coverage.

Reported By: Fixed By: Coordinated By: 
  • xjm of the Drupal Security Team
  • Drew Webber of the Drupal Security Team
Categories: Technology
Additional Terms