Blogroll: Drupal Contrib Security

I read blogs, as well as write one. The 'blogroll' on this site reproduces some posts from some of the people I enjoy reading. There are currently 8 posts from the blog 'Drupal Contrib Security.'

Disclaimer: Reproducing an article here need not necessarily imply agreement or endorsement!

Subscribe to Drupal Contrib Security feed
Updated: 3 hours 16 sec ago

Menu Item Extras - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2019-050

Wed, 22/05/2019 - 17:29
Project: Menu Item ExtrasDate: 2019-May-22Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Request ForgeryDescription: 

This module enables you to handle fields for Custom Menu Links.
The module doesn't sufficiently check requests to one of the module controllers if the user has permission 'administer menu'.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create content.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

Workflow - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-049

Wed, 22/05/2019 - 17:27
Project: WorkflowDate: 2019-May-22Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: 

The Workflow module enables you to create arbitrary Workflows, and assign them to Entities.
The module doesn't sufficiently escape HTML in the field settings leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer nodes" and "administer workflow".

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
Categories: Technology

Multiple Registration - Critical - Access bypass - SA-CONTRIB-2019-048

Wed, 15/05/2019 - 18:13
Project: Multiple RegistrationDate: 2019-May-15Security risk: Critical 19∕25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

This module enables you to use special routes for user registration with special roles and custom field sets defined for the role.

The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role.

This vulnerability is mitigated on sites where account approval is required as the user starts as blocked but still gets the "Administrator" role.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
  • Cash Williams of the Drupal Security Team
  • Categories: Technology

    Opigno Learning path - Moderately critical - Access bypass - SA-CONTRIB-2019-047

    Wed, 15/05/2019 - 18:09
    Project: Opigno Learning pathDate: 2019-May-15Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

    In certain configuration cases, when a learning path is configured as semi-private, anonymous users are allowed to join a learning path when they should not.

    Solution: 

    Install the latest version:

    Also see the Opigno Learning path project page.

    Reported By: Fixed By: Coordinated By: 
    Categories: Technology

    Opigno forum - Less critical - Access bypass - SA-CONTRIB-2019-046

    Wed, 15/05/2019 - 18:07
    Project: Opigno forumDate: 2019-May-15Security risk: Less critical 9∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassDescription: 

    In certain circumstances it is possible that certain forum information is available to unprivileged users because the access check is done with node access instead of grants.

    This vulnerability is mitigated by the fact that the module itself does not disclose information but only if there are listings such as views where the site builder / developer has not taken this into account.

    Solution: 

    Install the latest version:

    Also see the Opigno forum project page.

    Reported By: Fixed By: Coordinated By: 
    Categories: Technology

    TableField - Critical - Remote Code Execution - SA-CONTRIB-2019-045

    Wed, 17/04/2019 - 19:21
    Project: TableFieldDate: 2019-April-17Security risk: Critical 16∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Remote Code ExecutionDescription: 

    This module allows you to attach tabular data to an entity.

    The module doesn't sufficiently determine that the data being unserialized is the contents of a tablefield when users request a CSV export, which could lead to Remote Code Execution via Object Injection.

    This vulnerability is mitigated by the fact that an attacker must have a role with the permission 'export tablefield', and be able to insert a payload into an entity's field.

    Solution: 

    Install the latest version:

    • If you use the Tablefield module 7.x-3.x branch for Drupal 7.x, upgrade to tablefield 7.x-3.4

    Reported By: Fixed By: Coordinated By: 
    Categories: Technology

    Stage File Proxy - Less critical - Denial of Service - SA-CONTRIB-2019-044

    Wed, 17/04/2019 - 16:46
    Project: Stage File ProxyVersion: 7.x-1.x-devDate: 2019-April-17Security risk: Less critical 9∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:DefaultVulnerability: Denial of ServiceDescription: 

    Stage File Proxy is a general solution for getting production files on a development server on demand.

    The module doesn't sufficiently validate requested urls, allowing an attacker to send repeated requests for files that do not exist which could exhaust resources on the server where Stage File Proxy is installed.

    This vulnerability is mitigated by the fact that an attacker must make repeated requests. The vulnerability only exists on environments where Stage File Proxy is installed (it generally is not installed on production). It only affects sites where the "Hot Link" option is disabled (disabled is the default configuration).

    Solution: 

    Install the latest version:

    Also see the Stage File Proxy project page.

    Reported By: Fixed By: Coordinated By: 
    Categories: Technology

    Services - Less critical - Access bypass - SA-CONTRIB-2019-043

    Wed, 03/04/2019 - 18:46
    Project: ServicesVersion: 7.x-3.x-devDate: 2019-April-03Security risk: Less critical 9∕25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

    This module provides a standardized solution for building API's so that external clients can communicate with Drupal.

    The Services module has an access bypass vulnerability in its "attach_file" resource that allows users who have access to create or update nodes that include file fields to arbitrarily reference files they do not have access to, which can expose private files.

    This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit a node.

    Solution: 

    Install the latest version:

    Also see the Services project page.

    Reported By: Fixed By: Coordinated By: 
    Categories: Technology
    Additional Terms