- Security-news - lists.drupal.org

Webform - Critical - Access bypass - SA-CONTRIB-2020-016
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-016 Project: Webform [1] Date: 2020-May-06 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This webform module enables you to build 'Term select' and 'Term checkboxes' elements. The module doesn't sufficiently check term 'view' access when rendering the 'Term select' and 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term select' and 'Term checkboxes' elements. Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * James Gilliland [5] of the Drupal Security Team Fixed By: * Jacob Rockowitz [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/48673 [6] https://www.drupal.org/user/371407 [7] https://www.drupal.org/user/36762

1 0

Webform - Moderately critical - Cross site scripting - SA-CONTRIB-2020-015
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-015 Project: Webform [1] Date: 2020-May-06 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently sanitize Webform labels nor visibility conditions under the scenario of placing a block. When a webform block is placed and visible on a website any JavaScript code contained within the webform's label was executed. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform"). Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Ide Braakman [5] Fixed By: * bucefal91 [6] * Jacob Rockowitz [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/1879760 [6] https://www.drupal.org/user/504128 [7] https://www.drupal.org/user/371407 [8] https://www.drupal.org/user/36762

1 0

Webform - Moderately critical - Cross site scripting - SA-CONTRIB-2020-014
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-014 Project: Webform [1] Date: 2020-May-06 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently filter user input under in the scenario when a webform is edited, namely the message related to character min/max counter does not undergo sufficient filtering and thus allows execution of JavaScript code through it. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform"). Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Krzysztof Domański [5] Fixed By: * Krzysztof Domański [6] * Lee Rowlands [7] of the Drupal Security Team * Jacob Rockowitz [8] * bucefal91 [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/3572982 [6] https://www.drupal.org/user/3572982 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/371407 [9] https://www.drupal.org/user/504128 [10] https://www.drupal.org/user/36762

1 0

Webform - Moderately critical - Cross site scripting - SA-CONTRIB-2020-013
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-013 Project: Webform [1] Date: 2020-May-06 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: The Webform module allows site builders to create forms. The module doesn't sufficiently prevent malicious code from being render via an options elements (i.e select menu, checkboxes, radios, etc...) under the scenario where the site builder allows the raw option value to be displayed. This vulnerability is mitigated by the fact that site builder must be allowed to build webform and select raw as the options element's submission display. Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Dan Chadwick [5] Fixed By: * Jacob Rockowitz [6] * Dan Chadwick [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/504278 [6] https://www.drupal.org/user/371407 [7] https://www.drupal.org/user/504278 [8] https://www.drupal.org/user/36762

1 0

Webform - Moderately critical - Access bypass - SA-CONTRIB-2020-012
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-012 Project: Webform [1] Date: 2020-May-06 Security risk: *Moderately critical* 13∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently validate data submitted into Webform Signature element during webform submission creation. This allows a malicious user to generate and extract HMAC hashes for arbitrary data. Such HMAC hashes are used across multiple spots in Drupal 8 core and contrib modules. An extracted HMAC hash could be used to view restricted site content or log in as another user in certain situations. This vulnerability is mitigated by the fact that an attacker must be able to create a webform submission with "Signature" element and then be able to view the submission. For Drupal instances that have "Signature" webform element available to users with low trust, it is advised to change the value of the hash salt within settings.php file to a new random value. Below we reference the specific extract from settings.php that is advised for change in such Drupal instances: /** * Salt for one-time login links, cancel links, form tokens, etc. * * This variable will be set to a random value by the installer. All one-time * login links will be invalidated if the value is changed. Note that if your * site is deployed on a cluster of web servers, you must ensure that this * variable has the same value on each server. * * For enhanced security, you may set this variable to the contents of a file * outside your document root; you should also ensure that this file is not * stored with backups of your database. * * Example: * @code * $settings['hash_salt'] = file_get_contents('/home/example/salt.txt'); * @endcode */ $settings['hash_salt'] = 'new-value-here'; Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Heine [5] of the Drupal Security Team Fixed By: * Jacob Rockowitz [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/17943 [6] https://www.drupal.org/user/371407 [7] https://www.drupal.org/user/36762

1 0

Webform - Critical - Remote Code Execution - SA-CONTRIB-2020-011
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-011 Project: Webform [1] Date: 2020-May-06 Security risk: *Critical* 17∕25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote Code Execution Description: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently filter webform element properties (attributes) under the scenario of editing a webform. Malicious user could craft such an attribute (#element_validate, for example) that would invoke execution of undesired PHP code. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform"). Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Jacob Rockowitz [5] Fixed By: * Jacob Rockowitz [6] * Heine [7] of the Drupal Security Team * bucefal91 [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/371407 [6] https://www.drupal.org/user/371407 [7] https://www.drupal.org/user/17943 [8] https://www.drupal.org/user/504128 [9] https://www.drupal.org/user/36762

1 0

JSON:API - Critical - Unsupported - SA-CONTRIB-2020-010
by security-news＠drupal.org 15 Apr '20

15 Apr '20

View online: https://www.drupal.org/sa-contrib-2020-010 Project: JSON:API [1] Version: 8.x-1.26 Date: 2020-April-15 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The security team and module maintainers are marking this project unsupported. Both the 8.x-1.x and 8.x-2.x versions are unsupported, and users of either version are strongly encouraged to upgrade to a supported version of Drupal core, which includes a supported version of JSON:API. The eventual removal of security coverage for the JSON:API contributed module was announced with the release of JSON:API 8.x-1.22 [3] on 28 June 2018. Additionally, there is a known security issue with the 8.x-1.x branch of the project that will not be fixed by the maintainers. That issue is not present in the 8.x-2.x branch of the project, nor is it present in Drupal core. Solution: Users of the module are encouraged to upgrade to a supported version of Drupal core, which is distributed with a supported version of JSON:API. If your site is currently using a release from the 8.x-1.x branch of the module, you may be required to apply fixes for the breaking changes documented here [4]. Also see the JSON:API [5] project page. Reported By: * Gabe Sullice [6] * Alex Bronstein [7] * Wim Leers [8] * Mateu Aguiló Bosch [9] Fixed By: * Gabe Sullice [10] * Alex Bronstein [11] * Wim Leers [12] * Mateu Aguiló Bosch [13] Coordinated By: * Greg Knaddison [14] of the Drupal Security Team [1] https://www.drupal.org/project/jsonapi [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/jsonapi/releases/8.x-1.22 [4] https://www.drupal.org/list-changes/jsonapi/published?to_branch=8.x-2.x [5] https://www.drupal.org/project/jsonapi [6] https://www.drupal.org/user/2287430 [7] https://www.drupal.org/user/78040 [8] https://www.drupal.org/user/99777 [9] https://www.drupal.org/user/550110 [10] https://www.drupal.org/user/2287430 [11] https://www.drupal.org/user/78040 [12] https://www.drupal.org/user/99777 [13] https://www.drupal.org/user/550110 [14] https://www.drupal.org/user/36762

1 0

Spamicide - Critical - Access bypass - SA-CONTRIB-2020-009
by security-news＠drupal.org 08 Apr '20

08 Apr '20

View online: https://www.drupal.org/sa-contrib-2020-009 Project: Spamicide [1] Date: 2020-April-08 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The Spamicide module protects Drupal forms with a form field that is hidden from normal users, but visible to spam bots. The module doesn't require appropriate permissions for administrative pages leading to an Access Bypass. Solution: Install the latest version: * If you use the spamicide module for Drupal 7.x, upgrade to spamicide 7.x-1.3 [3] Also see the Spamicide [4] project page. Reported By: * ms7821 [5] Fixed By: * Szczepan Musial [6] * ms7821 [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/spamicide [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/spamicide/releases/7.x-1.3 [4] https://www.drupal.org/project/spamicide [5] https://www.drupal.org/user/3637029 [6] https://www.drupal.org/user/2870321 [7] https://www.drupal.org/user/3637029 [8] https://www.drupal.org/user/36762

1 0

Svg Image - Critical - Cross site scripting - SA-CONTRIB-2020-008
by security-news＠drupal.org 25 Mar '20

25 Mar '20

View online: https://www.drupal.org/sa-contrib-2020-008 Project: Svg Image [1] Date: 2020-March-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross site scripting Description: SVG Image module allows to upload SVG files. The module did not sufficiently protect against malicious code inside SVG files leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission to upload an SVG file. Solution: Install the latest version: * If you use the SVG Image module for Drupal 8.x, upgrade to Svg Image 8.x-1.10 [3] Also see the Svg Image [4] project page. Reported By: * Dmitry Kiselev [5] Fixed By: * Yaroslav Lushnikov [6] * Dmitry Kiselev [7] * Jeroen Tubex [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/svg_image [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/svg_image/releases/8.x-1.10 [4] https://www.drupal.org/project/svg_image [5] https://www.drupal.org/user/1945174 [6] https://www.drupal.org/user/2870933 [7] https://www.drupal.org/user/1945174 [8] https://www.drupal.org/user/2228934 [9] https://www.drupal.org/user/36762

1 0

CKEditor - WYSIWYG HTML editor - Moderately critical - Cross site scripting - SA-CONTRIB-2020-007
by security-news＠drupal.org 18 Mar '20

18 Mar '20

View online: https://www.drupal.org/sa-contrib-2020-007 Project: CKEditor - WYSIWYG HTML editor [1] Date: 2020-March-18 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Description: The CKEditor module (and its predecessor, FCKeditor module) allows Drupal to replace textarea fields with CKEditor 3.x/4.x (FCKeditor 2.x in case of FCKeditor module) - a visual HTML editor, sometimes called WYSIWYG editor. Due to the usage of the JavaScript `eval()` function on non-filtered data in admin section, it was possible for a user with permission to create content visible in the admin area to inject specially crafted malicious script which causes Cross Site Scripting (XSS). The problem existed in CKEditor module for Drupal, not in JavaScript libraries with the same names. Solution: Install the latest version: * If you use the CKEditor module for Drupal 7.x, upgrade to CKEditor 7.x-1.19 [3] Also see the CKEditor- WYSIWYG HTML editor [4] project page Reported By: * Yonatan Offek [5] Fixed By: * Robert Mikołajuk [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/ckeditor [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ckeditor/releases/7.x-1.19 [4] https://www.drupal.org/project/ckeditor [5] https://www.drupal.org/user/194009 [6] https://www.drupal.org/user/2793801 [7] https://www.drupal.org/user/36762

1 0