July 2020 - Security-news - lists.drupal.org

Hostmaster (Aegir) - Moderately critical - Access bypass, Arbitrary code execution - SA-CONTRIB-2020-031
by security-news＠drupal.org 29 Jul '20

29 Jul '20

View online: https://www.drupal.org/sa-contrib-2020-031 Project: Hostmaster (Aegir) [1] Version: 7.x-3.x-dev Date: 2020-July-29 Security risk: *Moderately critical* 14∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass, Arbitrary code execution Description: Aegir [3] is a powerful hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. Given that * Aegir can use both Apache and Nginx Web servers, * Apache allows configuration-writing users to escalate their privileges to the superuser root, and * Aegir's operations are performed by the GNU/Linux user aegir, It follows that: * Users with access to the aegir account can escalate their privileges to root. * Any PHP code submitted through the front-end Web UI via enabling modules (such as PHP [4], Views PHP [5], and Computed Field [6]) could be run as root though a cron [7] hook implementation [8]. (Aegir runs cron through the aegir user via Drush [9].) This vulnerability is mitigated by the fact that * an attacker must have access to the aegir account, and * the Web server must be Apache. While it was generally assumed that aegir access should only be provided to trusted users (i.e. users who also have access to root), this wasn't explicitly stated. The documentation has since been updated. Solution: If you're running Aegir and have granted untrusted users access to the aegir account, 1) revoke aegir account access for users who you would not trust with root access, 2) disable any module functionality on the hosted Drupal sites that allows PHP code to be entered on the front-end Web UI. Computed Field, for example, can still be used safely by providing code from the back-end only. (See Stop allowing PHP from being entered on the Web UI [10] for a plan to enforce this.) We do not recommend switching to an Nginx Web server instead of revoking access. This is because there could be as-yet-unknown privilege-escalation exploits involving Nginx (as with any other piece of software). /Switching to Nginx/ While not recommended, if this is something you'd like to do in addition to making the above change, we can offer some information on how to do it. While there may eventually be a migration path to convert existing Apache installations to Nginx, the recommended approach is currently: 1) Set up a new Aegir installation [11] using Nginx. 2) Remotely import sites [12] from the original Apache server. 3) Decommission the original Apache server. Also see the Hostmaster (Aegir) [13] project page. Reported By: * Noam Rathaus [14] Fixed By: * Colan Schwartz [15] Coordinated By: * Heine [16]of the Drupal Security Team * Greg Knaddison [17]of the Drupal Security Team [1] https://www.drupal.org/project/hostmaster [2] https://www.drupal.org/security-team/risk-levels [3] https://www.aegirproject.org/ [4] https://www.drupal.org/project/php [5] https://www.drupal.org/project/views_php [6] https://www.drupal.org/project/computed_field [7] https://www.drupal.org/docs/administering-a-drupal-site/cron-automated-task… [8] https://www.drupal.org/docs/creating-custom-modules/understanding-hooks [9] https://en.wikipedia.org/wiki/Drush [10] https://www.drupal.org/project/computed_field/issues/3143854 [11] https://docs.aegirproject.org/install/ [12] https://docs.aegirproject.org/usage/sites/importing/#remote-import [13] https://www.drupal.org/project/hostmaster [14] https://www.drupal.org/user/3645736 [15] https://www.drupal.org/user/58704 [16] https://www.drupal.org/user/17943 [17] https://www.drupal.org/user/36762

1 0

Group - Critical - Information Disclosure - SA-CONTRIB-2020-030
by security-news＠drupal.org 29 Jul '20

29 Jul '20

View online: https://www.drupal.org/sa-contrib-2020-030 Project: Group [1] Version: 8.x-1.x-dev Date: 2020-July-29 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Information Disclosure Description: This module enables you to hand out permissions on a smaller subset, section or community of your website. The module used to leverage the node grants system but turned it off in its recent 8.x-1.0 release in favor of a system that works for ALL entity types, not just nodes. By doing so, some regular node access checks turned from neutral into allowed because of the way the node grants system operates. This vulnerability is mitigated by the fact that an attacker must have the GroupNode plugin installed on their website and have no other hook_node_grants() implementations on their website aside from the one that was recently removed by Group. If you do not use the GroupNode plugin or still have hook_node_grants() implementing modules enabled, your site may not be affected. Solution: Install the latest version: * If you are using 8.x-1.0-rc5 you can keep using that version or upgrade to 8.x-1.1 [3] * If you are using 8.x-1.0 you should upgrade to 8.x-1.1 [4] Reported By: * Kristiaan Van den Eynde [5] Fixed By: * Kristiaan Van den Eynde [6] Coordinated By: * Greg Knaddison [7] Of the Drupal Security Team [1] https://www.drupal.org/project/group [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/group/releases/8.x-1.1 [4] https://www.drupal.org/project/group/releases/8.x-1.1 [5] https://www.drupal.org/user/1345130 [6] https://www.drupal.org/user/1345130 [7] https://www.drupal.org/u/greggles

1 0

Modal Form - Critical - Access bypass - SA-CONTRIB-2020-029
by security-news＠drupal.org 22 Jul '20

22 Jul '20

View online: https://www.drupal.org/sa-contrib-2020-029 Project: Modal Form [1] Version: 8.x-1.x-dev Date: 2020-July-22 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The Modal form module is a toolset for quick start of using forms in modal windows. Any form is available for view and submit when the modal_form module is installed. The only requirement is to know the form's fully-qualified class name. Solution: Upgrade to modal_form-8.x-1.2 [3]. Also see the Modal Form [4] project page. Reported By: * Dave Long [5] Fixed By: * Sergii Bondarenko [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/modal_form [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/modal_form/releases/8.x-1.2 [4] https://www.drupal.org/project/modal_form [5] https://www.drupal.org/user/246492 [6] https://www.drupal.org/user/2802285 [7] https://www.drupal.org/user/36762

1 0

Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2020-028
by security-news＠drupal.org 22 Jul '20

22 Jul '20

View online: https://www.drupal.org/sa-contrib-2020-028 Project: Apigee Edge [1] Version: 8.x-1.x-dev Date: 2020-July-22 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: The Apigee Edge module allows connecting a Drupal site to Apigee Edge in order to build a developer portal. It contains an "Apigee Edge Teams" submodule that provides shared app functionality by allowing developers to be organized into teams. The "Apigee Edge Teams" submodule has an information disclosure vulnerability. The "Add team member" form displays an email autocomplete field which can expose the email addresses of other accounts in the system. This vulnerability is mitigated by the fact that to have access to the form, the site must have the Apigee Edge Teams submodule enabled, and the user must have a team role that has the "Manage team members" permission. (Note that team roles and permissions are not related to Drupal core roles and permissions). Solution: Install the latest version: * If you use the apigee_edge_teams submodule for Drupal 8.x, upgrade to Apigee Edge module 8.x-1.12 [3] Also see the Apigee Edge [4] project page. Reported By: * Arlina Espinoza Rhoton [5] Fixed By: * Arlina Espinoza Rhoton [6] * Chris Novak [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/apigee_edge [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/apigee_edge/releases/8.x-1.12 [4] https://www.drupal.org/project/apigee_edge [5] https://www.drupal.org/user/1055344 [6] https://www.drupal.org/user/1055344 [7] https://www.drupal.org/user/880416 [8] https://www.drupal.org/user/36762

1 0

Easy Breadcrumb - Moderately critical - Cross site scripting - SA-CONTRIB-2020-027
by security-news＠drupal.org 22 Jul '20

22 Jul '20

View online: https://www.drupal.org/sa-contrib-2020-027 Project: Easy Breadcrumb [1] Version: 8.x-1.x-dev Date: 2020-July-22 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website. The module doesn't sufficiently sanitize editor input in certain circumstances leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability requires the user have 'administer Easy Breadcrumb settings permission'. Solution: Install the latest version: * If you use the Easy Breadcrumb module for Drupal 8, upgrade to Easy Breadcrumb 8.x-1.13 [3] Also see the Easy Breadcrumb [4] project page. Reported By: * Greg Boggs [5] Fixed By: * Greg Boggs [6] * Samuel Mortenson [7] of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/easy_breadcrumb [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/easy_breadcrumb/releases/8.x-1.13 [4] https://www.drupal.org/project/easy_breadcrumb [5] https://www.drupal.org/user/153069 [6] https://www.drupal.org/user/153069 [7] https://www.drupal.org/user/2582268 [8] https://www.drupal.org/user/36762

1 0

Renderkit - Less critical - Access bypass - SA-CONTRIB-2020-026
by security-news＠drupal.org 01 Jul '20

01 Jul '20

View online: https://www.drupal.org/sa-contrib-2020-026 Project: Renderkit [1] Version: 7.x-1.x-dev Date: 2020-July-01 Security risk: *Less critical* 9∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: The renderkit module contains components which can transform the display of field items sent to it. Some of these components do not respect the '#access' property on the field render element, and thus can make rendered field values visible to visitors who would otherwise not be allowed to see those field values. This only occurs if all of the following conditions are true: * Your site has a field where viewing access is restricted on field level, e.g. using the "Field permissions" module. * The access-restricted field is displayed using the "Field with formatter" entity display from renderkit, in combination with one of the affected field display processor components. Solution: If a site is affected there are 2 steps to fix this issue on a site: .... Step 1: Install the latest version of renderkit: * If you use the renderkit module for Drupal 7.x, upgrade to Renderkit 7.x-1.14 [3]. .... Step 2: Review your custom modules. Look for classes that implement FieldDisplayProcessorInterface. Consider to extend the FieldDisplayProcessorBase class instead of implementing the interface. Also see the Renderkit [4] project page. Reported By: * Andreas Hennings [5] Fixed By: * Andreas Hennings [6] * mibfire [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/renderkit [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/renderkit/releases/7.x-1.14 [4] https://www.drupal.org/project/renderkit [5] https://www.drupal.org/user/459338 [6] https://www.drupal.org/user/459338 [7] https://www.drupal.org/user/155136 [8] https://www.drupal.org/user/36762

1 0