Drupal contrib security advisories

Subscribe to Drupal contrib security advisories hírcsatorna
Frissítve: 1 óra 17 perc
2020. augusztus 5.

Group - Moderately critical - Information disclosure - SA-CONTRIB-2020-033

Project: GroupVersion: 8.x-1.x-devDate: 2020-August-05Security risk: Moderately critical 11∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureDescription: 

The Group module enables you to hand out permissions on a smaller subset, section or community of your website.

Under very specific circumstances, where two group types support the same content, yet hand out different permissions, non-members of the first group type may use the set of permissions of the 2nd group type for the grouped content.

This vulnerability is mitigated by the fact that you must already have a rare set-up and the two group types are configured in a way where one is more permissive than the other over the same type of content.

Solution: 

Install the latest version:

  • If you are using 8.x-1.0 or later, you should upgrade to 8.x-1.2.
  • If you are using 8.x-1.0-rc5, that version is not affected by this issue. You can also consider upgrading to 8.x-1.2.
Reported By: Fixed By: 
2020. augusztus 5.

Group - Moderately critical - Information disclosure - SA-CONTRIB-2020-032

Project: GroupVersion: 8.x-1.x-devDate: 2020-August-05Security risk: Moderately critical 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information disclosureDescription: 

The Group module enables you to hand out permissions on a smaller subset, section or community of your website.

With the 1.1 security release, new code was introduced to ensure proper access for all entity types, but a mistake introduced unexpected access to unpublished nodes.

Solution: 

Install the latest version:

  • If you are using 8.x-1.0 or later, you should upgrade to 8.x-1.2.
  • If you are using 8.x-1.0-rc5, that version is not affected by this issue. You can also consider upgrading to 8.x-1.2.
Reported By: Fixed By: 
2020. július 29.

Hostmaster (Aegir) - Moderately critical - Access bypass, Arbitrary code execution - SA-CONTRIB-2020-031

Project: Hostmaster (Aegir)Version: 7.x-3.x-devDate: 2020-July-29Security risk: Moderately critical 14∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Access bypass, Arbitrary code executionDescription: 

Aegir is a powerful hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites.

Given that

  • Aegir can use both Apache and Nginx Web servers,
  • Apache allows configuration-writing users to escalate their privileges to the superuser root, and
  • Aegir's operations are performed by the GNU/Linux user aegir,

It follows that:

  • Users with access to the aegir account can escalate their privileges to root.
  • Any PHP code submitted through the front-end Web UI via enabling modules (such as PHP, Views PHP, and Computed Field) could be run as root though a cron hook implementation. (Aegir runs cron through the aegir user via Drush.)

This vulnerability is mitigated by the fact that

  • an attacker must have access to the aegir account, and
  • the Web server must be Apache.

While it was generally assumed that aegir access should only be provided to trusted users (i.e. users who also have access to root), this wasn't explicitly stated. The documentation has since been updated.

Solution: 

If you're running Aegir and have granted untrusted users access to the aegir account,

  1. revoke aegir account access for users who you would not trust with root access,
  2. disable any module functionality on the hosted Drupal sites that allows PHP code to be entered on the front-end Web UI. Computed Field, for example, can still be used safely by providing code from the back-end only. (See Stop allowing PHP from being entered on the Web UI for a plan to enforce this.)

We do not recommend switching to an Nginx Web server instead of revoking access. This is because there could be as-yet-unknown privilege-escalation exploits involving Nginx (as with any other piece of software).

Switching to Nginx

While not recommended, if this is something you'd like to do in addition to making the above change, we can offer some information on how to do it.

While there may eventually be a migration path to convert existing Apache installations to Nginx, the recommended approach is currently:

  1. Set up a new Aegir installation using Nginx.
  2. Remotely import sites from the original Apache server.
  3. Decommission the original Apache server.

Also see the Hostmaster (Aegir) project page.

Reported By: Fixed By: Coordinated By: 
2020. július 29.

Group - Critical - Information Disclosure - SA-CONTRIB-2020-030

Project: GroupVersion: 8.x-1.x-devDate: 2020-July-29Security risk: Critical 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Information DisclosureDescription: 

This module enables you to hand out permissions on a smaller subset, section or community of your website.

The module used to leverage the node grants system but turned it off in its recent 8.x-1.0 release in favor of a system that works for ALL entity types, not just nodes. By doing so, some regular node access checks turned from neutral into allowed because of the way the node grants system operates.

This vulnerability is mitigated by the fact that an attacker must have the GroupNode plugin installed on their website and have no other hook_node_grants() implementations on their website aside from the one that was recently removed by Group. If you do not use the GroupNode plugin or still have hook_node_grants() implementing modules enabled, your site may not be affected.

Solution: 

Install the latest version:

  • If you are using 8.x-1.0-rc5 you can keep using that version or upgrade to 8.x-1.1
  • If you are using 8.x-1.0 you should upgrade to 8.x-1.1
Reported By: Fixed By: Coordinated By: 
2020. július 22.

Modal Form - Critical - Access bypass - SA-CONTRIB-2020-029

Project: Modal FormVersion: 8.x-1.x-devDate: 2020-July-22Security risk: Critical 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

The Modal form module is a toolset for quick start of using forms in modal windows.

Any form is available for view and submit when the modal_form module is installed. The only requirement is to know the form's fully-qualified class name.

Solution: 

Upgrade to modal_form-8.x-1.2.

Also see the Modal Form project page.

Reported By: Fixed By: Coordinated By: 
2020. július 22.

Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2020-028

Project: Apigee EdgeVersion: 8.x-1.x-devDate: 2020-July-22Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

The Apigee Edge module allows connecting a Drupal site to Apigee Edge in order to build a developer portal. It contains an "Apigee Edge Teams" submodule that provides shared app functionality by allowing developers to be organized into teams.

The "Apigee Edge Teams" submodule has an information disclosure vulnerability. The "Add team member" form displays an email autocomplete field which can expose the email addresses of other accounts in the system.

This vulnerability is mitigated by the fact that to have access to the form, the site must have the Apigee Edge Teams submodule enabled, and the user must have a team role that has the "Manage team members" permission. (Note that team roles and permissions are not related to Drupal core roles and permissions).

Solution: 

Install the latest version:

Also see the Apigee Edge project page.

Reported By: Fixed By: Coordinated By: 
2020. július 22.

Easy Breadcrumb - Moderately critical - Cross site scripting - SA-CONTRIB-2020-027

Project: Easy BreadcrumbVersion: 8.x-1.x-devDate: 2020-July-22Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

This module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website.

The module doesn't sufficiently sanitize editor input in certain circumstances leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability requires the user have 'administer Easy Breadcrumb settings permission'.

Solution: 

Install the latest version:

Also see the Easy Breadcrumb project page.

Reported By: Fixed By: Coordinated By: 
2020. július 1.

Renderkit - Less critical - Access bypass - SA-CONTRIB-2020-026

Project: RenderkitVersion: 7.x-1.x-devDate: 2020-July-01Security risk: Less critical 9∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassDescription: 

The renderkit module contains components which can transform the display of field items sent to it.

Some of these components do not respect the '#access' property on the field render element, and thus can make rendered field values visible to visitors who would otherwise not be allowed to see those field values.

This only occurs if all of the following conditions are true:

  • Your site has a field where viewing access is restricted on field level, e.g. using the "Field permissions" module.
  • The access-restricted field is displayed using the "Field with formatter" entity display from renderkit, in combination with one of the affected field display processor components.
Solution: 

If a site is affected there are 2 steps to fix this issue on a site:

Step 1: Install the latest version of renderkit: Step 2: Review your custom modules.

Look for classes that implement FieldDisplayProcessorInterface.
Consider to extend the FieldDisplayProcessorBase class instead of implementing the interface.

Also see the Renderkit project page.

Reported By: Fixed By: Coordinated By: 
2020. június 17.

Internationalization - Moderately critical - Cross site scripting - SA-CONTRIB-2020-025

Project: InternationalizationVersion: 7.x-1.x-devDate: 2020-June-17Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

The Internationalization (i18n) module is a collection of modules to extend Drupal core multilingual capabilities and allows to build real life multilingual sites.

A value in the term translation module is displayed without being escaped leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit terms in " on a taxonomy vocabulary with i18n term translation enabled and the victim uses the i18n term translation page.

Solution: 

Install the latest version:

Also see the Internationalization project page.

Reported By: Fixed By: Coordinated By: 
2020. június 10.

Open ReadSpeaker - Moderately critical - Cross site scripting - SA-CONTRIB-2020-024

Project: Open ReadSpeakerVersion: 8.x-1.x-devDate: 2020-June-10Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

This module enables you to add a configured ReadSpeaker button for text-to-speech for your site visitors.

The module doesn't sufficiently sanitize block configuration causing a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".

Solution: 

Install the latest version:

Also see the Open ReadSpeaker project page.

Reported By: Fixed By: Coordinated By: 
2020. június 10.

YubiKey - Less critical - Access bypass - SA-CONTRIB-2020-023

Project: YubiKeyVersion: 7.x-2.x-devDate: 2020-June-10Security risk: Less critical 9∕25 AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This module enables you to use a Yubikey device to protect your Drupal user account. YubiKey is a secure method for logging into many websites using a cryptographically secure USB token.

The module doesn't sufficiently implement login flood control when the module is configured for YubiKey OTP only. This allows an attacker to attempt many YubiKey OTP codes. However, a brute force attack on this code is not practical in most situations given the length and randomness of the OTP codes.

Solution: 

Install the latest version:

Also see the YubiKey project page.

Reported By: Fixed By: Coordinated By: 
2020. június 3.

Services - Moderately critical - Access bypass - SA-CONTRIB-2020-022

Project: ServicesVersion: 7.x-3.x-devDate: 2020-June-03Security risk: Moderately critical 11∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This module provides a standardized solution for building API's so that external clients can communicate with Drupal.

The module's taxonomy term index resource doesn't take into consideration certain access control tags provided (but unused) by core, that certain contrib modules depend on.

This vulnerability is mitigated by the fact your site must have the taxonomy term index resource enabled, your site must have a contributed module enabled which utilizes taxonomy term access control, and an attacker must know your api endpoint's path.

Solution: 

Install the latest version:

Also see the Services project page.

Reported By: Fixed By: Coordinated By: 
2020. május 27.

Password Reset Landing Page (PRLP) - Highly critical - Access bypass - SA-CONTRIB-2020-021

Project: Password Reset Landing Page (PRLP)Date: 2020-May-27Security risk: Highly critical 20∕25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This module enables you to force a password update when using password reset link.
The module doesn't sufficiently validate the login URL allowing a malicious user to use a specially crafted URL to log in as another user.

Solution: 

Install the latest version:

  • If you use the PRLP module for Drupal 8.x, upgrade to PRLP 8.x-1.5

Also see the Password Reset Landing Page (PRLP) project page.

Reported By: Fixed By: Coordinated By: 
2020. május 27.

Drupal Commerce - Moderately critical - Access bypass - SA-CONTRIB-2020-020

Project: Drupal CommerceDate: 2020-May-27Security risk: Moderately critical 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit orders by anonymous users. In this configuration, customers who do not choose to create an account upon checkout completion remain anonymous, and the resulting orders are never assigned an owner.

When anonymous users are granted the "View own orders" permission, they are able to see any such anonymous order via direct navigation to its view page. The module does not include extra access control necessary to ensure anonymous users are only able to view their own previously placed orders.

This vulnerability is mitigated by the fact that a site must be configured to permit anonymous checkout and an attacker must be an anonymous user with the permission "View own orders".

Solution: 

Install the latest version:

Also see the Drupal Commerce project page.

Reported By: Fixed By: Coordinated By: 
2020. május 13.

reCAPTCHA v3 - Critical - Access bypass - SA-CONTRIB-2020-019

Project: reCAPTCHA v3Date: 2020-May-13Security risk: Critical 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

The reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3.

If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for attackers to submit invalid or incomplete forms.

This vulnerability only affects forms that are protected by reCaptcha v3 and have server side validation steps (e.g required field or custom validation functions).

Solution: 

Install the latest version:

Also see the reCAPTCHA v3 project page.

Reported By: Fixed By: Coordinated By: 
2020. május 13.

Webform - Critical - Access bypass - SA-CONTRIB-2020-018

Project: WebformDate: 2020-May-13Security risk: Critical 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This webform module enables you to build a 'Term checkboxes' element.

The module doesn't sufficiently check term 'view' access when rendering 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term checkboxes' element.

Solution: 

Install the latest version:

Also see the Webform project page.

Reported By: Fixed By: Coordinated By: 
2020. május 6.

Webform - Moderately critical - Access bypass - SA-CONTRIB-2020-017

Project: WebformDate: 2020-May-06Security risk: Moderately critical 11∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassDescription: 

This module enables you to build forms and surveys in Drupal.

The Webform Node sub-module allows these forms to be associated with a Drupal node. The Webform Node module does not implement access checking in the same manner as other nodes and entities. As such, writers of custom modules which implement webform_node, node, or entity access checks may not achieve the intended access results for Webform Node content.

There is no known exploit of this vulnerability and the vulnerability only exists on sites with custom code and a node access module in use.

Solution: 

Install the latest version:

Also see the Webform project page.

Reported By: Fixed By: Coordinated By: 
2020. május 6.

Webform - Critical - Access bypass - SA-CONTRIB-2020-016

Project: WebformDate: 2020-May-06Security risk: Critical 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This webform module enables you to build 'Term select' and 'Term checkboxes' elements.

The module doesn't sufficiently check term 'view' access when rendering the 'Term select' and 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term select' and 'Term checkboxes' elements.

Solution: 

Install the latest version:

Also see the Webform project page.

Reported By: Fixed By: Coordinated By: 
2020. május 6.

Webform - Moderately critical - Cross site scripting - SA-CONTRIB-2020-015

Project: WebformDate: 2020-May-06Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

This module enables you to build forms and surveys in Drupal.

The module doesn't sufficiently sanitize Webform labels nor visibility conditions under the scenario of placing a block. When a webform block is placed and visible on a website any JavaScript code contained within the webform's label was executed.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform").

Solution: 

Install the latest version:

Also see the Webform project page.

Reported By: Fixed By: Coordinated By: 
2020. május 6.

Webform - Moderately critical - Cross site scripting - SA-CONTRIB-2020-014

Project: WebformDate: 2020-May-06Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

This module enables you to build forms and surveys in Drupal.

The module doesn't sufficiently filter user input under in the scenario when a webform is edited, namely the message related to character min/max counter does not undergo sufficient filtering and thus allows execution of JavaScript code through it.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform").

Solution: 

Install the latest version:

Also see the Webform project page.

Reported By: Fixed By: Coordinated By: