Drupal contrib security advisories

Subscribe to Drupal contrib security advisories hírcsatorna
Frissítve: 1 óra 44 perc
2021. szeptember 22.

The Better Mega Menu - Moderately critical - Access bypass - SA-CONTRIB-2021-041

Project: The Better Mega MenuDate: 2021-September-22Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:DefaultVulnerability: Access bypassDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

This module has a vulnerability whereby users can select blocks as a menu item they don't have permission to view.

The vulnerability is mitigated by the fact that it can only be exploited by an attacker with the "Administer TB Mega Menu" permission.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. szeptember 22.

The Better Mega Menu - Critical - Cross Site Request Forgery - SA-CONTRIB-2021-040

Project: The Better Mega MenuDate: 2021-September-22Security risk: Critical 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

The module does not use CSRF tokens to protect routes for saving menu configurations.

This vulnerability can be exploited by an anonymous user.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. szeptember 22.

The Better Mega Menu - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-039

Project: The Better Mega MenuDate: 2021-September-22Security risk: Moderately critical 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

It does not sufficiently sanitize user input such that an admin with permissions to edit a menu may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities.

This vulnerability is mitigated by the fact that an attacker must have permission to administer mega menus and/or create or edit menu links, to inject the XSS.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. szeptember 22.

The Better Mega Menu - Moderately critical - Cross Site Scripting, Information Disclosure, Multiple vulnerabilities - SA-CONTRIB-2021-038

Project: The Better Mega MenuDate: 2021-September-22Security risk: Moderately critical 12∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Information Disclosure, Multiple vulnerabilitiesDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

The module does not sanitize values for CSS properties that are added by admins and rendered on the front-end, allowing attackers to inject malicious code into the front-end markup.

This vulnerability is mitigated by the fact that it can only be exploited by an attacker with permissions to administer TB Mega Menu, or a sophisticated anonymous user using a site-specific attack that exploits the Cross Site Request Forgery vulnerability that is fixed by this same release.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. szeptember 22.

Domain Group - Critical - Access bypass - SA-CONTRIB-2021-037

Project: Domain GroupDate: 2021-September-22Security risk: Critical 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This module enables sites to define a domain from Domain Access that points directly to a group page.

The module doesn't sufficiently manage the access to content administrative paths allowing an attacker to see and take actions on content (nodes) they should be allowed to.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. szeptember 22.

SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider - Moderately critical - Multiple vulnerabilities - SA-CONTRIB-2021-036

Project: SAML SP 2.0 Single Sign On (SSO) - SAML Service ProviderDate: 2021-September-22Security risk: Moderately critical 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Multiple vulnerabilitiesDescription: 

This module provides a solution to authenticate visitors using existing SAML providers.

Certain non-default configurations allow a malicious user to login as any chosen user.

The vulnerability is mitigated by the module's default settings which require the options "Either sign SAML assertions" and "x509 certificate".

Solution: 

Ensure that the "Either SAML response or SAML assertion must be signed" and "x509 certificate" options on the dedicated plugin page are both enabled.

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. szeptember 22.

Taxonomy Manager - Moderately critical - Access bypass - SA-CONTRIB-2021-035

Project: Taxonomy ManagerDate: 2021-September-22Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

This module provides a powerful interface for managing a taxonomy vocabulary. A vocabulary gets displayed in a dynamic tree view, where parent terms can be expanded to list their nested child terms or can be collapsed.

The module does not take the correct user permissions into account, allowing an attacker to delete and move terms.

The issue is mitigated by the fact that an attacker must have permission to create terms in the targeted vocabulary.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. szeptember 22.

Search API attachments - Critical - Arbitrary PHP code execution - SA-CONTRIB-2021-034

Project: Search API attachmentsDate: 2021-September-22Security risk: Critical 15∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Arbitrary PHP code executionDescription: 

This module enables you to extract the textual content of files for use on a website, e.g. to display it or or use it in search indexes.

The module doesn't sufficiently protect the administrator-defined commands which are executed on the server, which leads to post-authentication remote code execution by a limited set of users.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer search_api". Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission.

Solution: 

Install the latest version:

The 8.x branch does not have Security Coverage.

Reported By: Fixed By: Coordinated By: 
2021. szeptember 22.

File Extractor - Critical - Arbitrary PHP code execution - SA-CONTRIB-2021-033

Project: File ExtractorDate: 2021-September-22Security risk: Critical 15∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Arbitrary PHP code executionDescription: 

This module enables you to extract the textual content of files for use on a website, e.g. to display it or or use it in search indexes.

The module doesn't sufficiently protect the administrator-defined commands which are executed on the server, which leads to post-authentication remote code execution by a limited set of users.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer File Extractor" to access the settings form. Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. szeptember 22.

Commerce Core - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2021-032

Project: Commerce CoreDate: 2021-September-22Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypass, Information DisclosureDescription: 

This module provides a system for building an ecommerce solution in their Drupal site.

The module doesn't sufficiently verify access to profile data in certain circumstances.

This vulnerability is mitigated by the fact that an attacker must have permission to perform the checkout operation.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. szeptember 22.

Client-side Hierarchical Select - Moderately critical - Cross-site scripting - SA-CONTRIB-2021-031

Project: Client-side Hierarchical SelectDate: 2021-September-22Security risk: Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingDescription: 

The module provides a field widget for selecting taxonomy terms in a hierarchical fashion.

The module doesn't sanitize user input in certain cases, leading to a possible Cross-Site-Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit taxonomy terms to which the widget may apply.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. szeptember 22.

User hash - Moderately critical - Cache poisoning - SA-CONTRIB-2021-030

Project: User hashDate: 2021-September-22Security risk: Moderately critical 12∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Cache poisoningDescription: 

This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters.

The module doesn't sufficiently invalidate page output when the page_cache module is used.

This vulnerability is mitigated by the fact that an attacker must have a user hash that grants access to specific content and the attack must be timed to the reset of the page cache.

Solution: 

Install the latest version:

  • If you use the user_hash module for Drupal 8 or 9, upgrade to User Hash 2.0.1
Reported By: Fixed By: Coordinated By: 
2021. szeptember 15.

GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029

Project: GraphQLDate: 2021-September-15Security risk: Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassCVE IDs: CVE-2020-13675Description: 

This advisory addresses a similar issue to Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008.

The GraphQL module allows file uploads through its HTTP API. The module does not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

This vulnerability is mitigated by four factors:

  1. The GraphQL module must be enabled on the site.
  2. The GraphQL schema must expose a file upload by using the helper "src/GraphQL/Utility/FileUpload.php" in the module.
  3. An attacker must have access to that file upload via the GraphQL API.
  4. The site must employ a file validation module.
Solution: 

Install the latest version:

  • If you use the GraphQL module 8.x-4.x for Drupal 8.x or 9.x, upgrade to GraphQL 8.x-4.2
  • If you use the GraphQL module 8.x-3.x for Drupal 8.x no action is needed as a result of this advisory as the 8.x-3.x branch is not affected by this issue.
Reported By: Fixed By: Coordinated By: 
  • xjm of the Drupal Security Team
  • Drew Webber of the Drupal Security Team
2021. szeptember 15.

Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028

Project: Entity EmbedDate: 2021-September-15Security risk: Moderately critical 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13673Description: 

This advisory addresses a similar issue to Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006.

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

Solution: 

Install the latest version:

Drupal 7 versions of Entity Embed do not have a stable release and therefore do not receive security coverage.

Reported By: Fixed By: Coordinated By: 
  • xjm of the Drupal Security Team
  • Drew Webber of the Drupal Security Team
2021. augusztus 25.

Webform - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-026

Project: WebformDate: 2021-August-25Security risk: Moderately critical 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross Site ScriptingDescription: 

The Webform module uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Webform.

An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

For more information, see CKEditor's announcement of the release.

Solution: 

Install the latest version:

If you are using a previous release of the Webform module you can immediately do one of several options.

  1. Update Drupal
  2. If you are using Composer, run drush webform:libraries:composer > DRUPAL_ROOT/composer.libraries.json and run composer update
  3. If you are using Drush, run drush webform:libraries:update

Learn more about updating Webform libraries.

Reported By: Fixed By: Coordinated By: 
2021. augusztus 25.

Admin Toolbar - Moderately critical - Cross Site Scripting, Access Bypass - SA-CONTRIB-2021-025

Project: Admin ToolbarDate: 2021-August-25Security risk: Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Scripting, Access BypassDescription: 

The Admin Toolbar (admin_toolbar) module extends the default toolbar provided by Drupal Core with various features facilitating day-to-day editorial and administrative work.

The Admin Toolbar Search sub-module of this module

  • doesn't sanitize user input in certain cases, which leads to a Cross-Site-Scripting (XSS) vulnerability. An attacker that can create or edit certain entities, entity bundles or entity types may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities to target users with access to the Admin Toolbar Search search box, including site admins with privileged access.
  • doesn't properly check access in certain cases, which may result in an information disclosure vulnerability of entity type and bundle labels.

The vulnerability is mitigated by the facts, that:

  • the Admin Toolbar Search sub-module must be enabled.
  • an attacker must have one of several permissions, of which at least some are commonly only assigned to either editors, site builders or administrators.
  • a targeted account must have permission to use the search box provided by the Admin Toolbar Search sub-module.
Solution: 

Install the latest version:

Also see the Admin Toolbar project page.

Reported By: Fixed By: Coordinated By: 
2021. július 28.

Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2021-024

Project: Pages Restriction AccessDate: 2021-July-28Security risk: Critical 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This project enables administrators to restrict access from anonymous and regular users to pre-defined pages.

The administration routes used by the project lacked proper permissions, allowing untrusted users to access, create and modify the module's settings.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. július 21.

Form mode manager - Moderately critical - Access bypass - SA-CONTRIB-2021-023

Project: Form mode managerDate: 2021-July-21Security risk: Moderately critical 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Proof/TD:DefaultVulnerability: Access bypassDescription: 

This module provides a user interface that allows the implementation and use of Form modes without custom development.

The module does not sufficiently respect access restrictions to entity forms for routes it creates to use specific form modes.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to use a specific form mode, for example use X form mode.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. június 30.

Block Content Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-022

Project: Block Content Revision UIDate: 2021-June-30Security risk: Moderately critical 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassDescription: 

This module provides a revision UI for Block Content entities.

The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules.

This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Block Content Revision UI, and another affected module must be enabled.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
2021. június 30.

Linky Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-021

Project: Linky Revision UIDate: 2021-June-30Security risk: Moderately critical 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassDescription: 

This module provides a revision UI for Linky entities.

The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules.

This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Linky Revision UI, and another affected module must be enabled.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: