- Security-news - lists.drupal.org

Create user permission - Critical - Access bypass - SA-CONTRIB-2019-066
by security-news＠drupal.org 18 Sep '19

18 Sep '19

View online: https://www.drupal.org/sa-contrib-2019-066 Project: Create user permission [1] Version: 8.x-1.x-dev Date: 2019-September-18 Security risk: *Critical* 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module enables you to have a separate permission only for creating users. The module doesn't respect Drupal's setting for "Who can register accounts?" when set to "Visitors, but administrator approval is required". When this option is chosen, the module overrides the setting, and makes it possible to register accounts with no approval. This vulnerability can be mitigated by having other settings in place for account registration, such as requiring email verification for new accounts, or permitting account creation for "Administrators only". Solution: Install the latest version: * If you use the create_user_permission module for Drupal 8.x, upgrade to Create user permission 8.x-1.2 [3] Also see the Create user permission [4] project page. Reported By: * jddh [5] Fixed By: * Eirik Morland [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team * Drew Webber [9] of the Drupal Security Team [1] https://www.drupal.org/project/create_user_permission [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/create_user_permission/releases/8.x-1.2 [4] https://www.drupal.org/project/create_user_permission [5] https://www.drupal.org/user/509004 [6] https://www.drupal.org/user/1014468 [7] https://www.drupal.org/user/102818 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/255969

1 0

TableField - Moderately critical - Access bypass - SA-CONTRIB-2019-067
by security-news＠drupal.org 18 Sep '19

18 Sep '19

View online: https://www.drupal.org/sa-contrib-2019-067 Project: TableField [1] Version: 8.x-2.x-dev Date: 2019-September-18 Security risk: *Moderately critical* 12∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module allows you to attach tabular data to an entity. There is insufficient access checking for users with the ability to "Export Tablefield Data as CSV". They can export data from unpublished nodes or otherwise inaccessible entities. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Export Tablefield Data as CSV". Solution: Install the latest version: * If you use the Tablefield module for Drupal 8.x, upgrade to Tablefield 8.x-2.1 [3] Also see the TableField [4] project page. Reported By: * Mitch Portier [5] Fixed By: * Mitch Portier [6] * Jen Lampton [7] * Martin Postma [8] Coordinated By: * Chris McCafferty [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team * Drew Webber [11] of the Drupal Security Team [1] https://www.drupal.org/project/tablefield [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tablefield/releases/8.x-2.1 [4] https://www.drupal.org/project/tablefield [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/85586 [8] https://www.drupal.org/user/210402 [9] https://www.drupal.org/user/1850070 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/255969

1 0

Various 3rd Party Vulnerabilities - PSA-2019-09-04
by security-news＠drupal.org 04 Sep '19

04 Sep '19

View online: https://www.drupal.org/psa-2019-09-04 Date: 2019-September-04 Vulnerability: Various 3rd Party Vulnerabilities Description: In June of 2011, the Drupal Security Team issued Public Service Advisory PSA-2011-002 - External libraries and plugins [1]. 8 years later that is still the policy of the Drupal Security team. As Drupal core and modules leverage 3rd party code more and more it seems like an important time to remind site owners that they are responsible for monitoring security of 3rd party libraries. Here is the advice from 2011 which is even more relevant today: >Just like there's a need to diligently follow announcements and update >contributed modules downloaded from Drupal.org, there's also a need to >follow announcements by vendors of third-party libraries or plugins that are >required by such modules. > >Drupal's update module has no functionality to alert you to these >announcements. The Drupal security team will not release announcements about >security issues in external libraries and plugins. > -------- CURRENT PHPUNIT/MAILCHIMP LIBRARY EXPLOIT --------------------------- Recently we have become aware of a vulnerability that is being actively exploited on some Drupal sites. The vulnerability is in PHPUnit and has a CVE# CVE-2017-9841. The exploit targets Drupal sites that currently or previously used the Mailchimp or Mailchimp commerce module and still have a vulnerable version of the file sites/all/libraries/mailchimp/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php. See below for details on whether a file is vulnerable or not. The vulnerable file might be at other paths on your individual site, but an automated attack exists that is looking for that specific path. This attack can execute PHP on the server. Solution: Follow release announcements by the vendors of the external libraries and plugins you use. In this specific case, check for the existence of a file named eval-stdin.php and check its contents. If they match the new version in this commit [2] then it is safe. If the file reads from php://input then the codebase is vulnerable. This is not an indication of a site being compromised, just of it being vulnerable. To fix this vulnerability, update your libraries. In particular you should ensure the Mailchimp [3] and Mailchimp Ecommerce [4] modules *and their libraries* are updated. If you discover your site has been compromised, we have a guide of how to remediate a compromised site [5]. Also see the Drupal core [6] project page. Reported By: * Hans Rossel [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/node/1189632 [2] https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42… [3] https://www.drupal.org/project/mailchimp/ [4] https://www.drupal.org/project/mailchimp_ecommerce/ [5] https://www.drupal.org/docs/develop/security/your-drupal-site-got-hacked-no… [6] https://www.drupal.org/project/drupal [7] https://www.drupal.org/u/hansrossel [8] https://www.drupal.org/user/36762

1 0

Imagecache External - Critical - Insecure session token management - SA-CONTRIB-2019-065
by security-news＠drupal.org 21 Aug '19

21 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-065 Project: Imagecache External [1] Date: 2019-August-21 Security risk: *Critical* 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Insecure session token management Description: This module that allows you to store external images on your server and apply your own Image Styles. The module exposes cookies to external sites when making external image requests. This vulnerability is mitigated by using the whitelisted host feature to restrict external image requests from trusted sources. Solution: Install the latest version: * If you use the Imagecache External 8.x-1.0 version, upgrade to Imagecache External 8.x-1.1 version [3] Also see the Imagecache External [4] project page. Reported By: * Jason Want [5] * Heine Deelstra [6] of the Drupal Security Team Fixed By: * Heine Deelstra [7] of the Drupal Security Team * Baris Wanschers [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/imagecache_external [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/imagecache_external/releases/8.x-1.1 [4] https://www.drupal.org/project/imagecache_external [5] https://www.drupal.org/user/589890 [6] https://www.drupal.org/user/17943 [7] https://www.drupal.org/user/17943 [8] https://www.drupal.org/user/107229 [9] https://www.drupal.org/user/36762

1 0

Forms Steps - Critical - Access bypass - SA-CONTRIB-2019-064
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-064 Project: Forms Steps [1] Date: 2019-August-14 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: Forms Steps provides an UI to create form workflows using form modes. It creates quick and configurable multisteps forms. The module doesn't sufficiently check user permissions to access its workflows entities that allows to see any entities that have been created through the different steps of its multistep forms. This vulnerability is mitigated by the fact that you have to know the Forms Steps URL to create a content linked to the flow. Also, all created content is very hard to edit through the same flow as you have to know the URL and the linked hash to the content. Solution: Install the latest version: * If you use the Forms Steps module for Drupal 8.x, upgrade to Forms Steps 8.x-1.2 [3] Also see the Forms Steps [4] project page. Reported By: * solide-echt [5] Fixed By: * Hakim Rachidi [6] * solide-echt [7] * nicoloye [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/forms_steps [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/forms_steps/releases/8.x-1.2 [4] https://www.drupal.org/project/forms_steps [5] https://www.drupal.org/user/46176 [6] https://www.drupal.org/user/3008327 [7] https://www.drupal.org/user/46176 [8] https://www.drupal.org/user/315225 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/36762

1 0

External Links Filter - Moderately critical - Open Redirect Vulnerability - SA-CONTRIB-2019-063
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-063 Project: External Links Filter [1] Date: 2019-August-14 Security risk: *Moderately critical* 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Open Redirect Vulnerability Description: The External Link Filter module provides an input filter that replaces external links by a local link that redirects to the target URL. The module did not have protection for the Redirect URL to go where content authors intended. Solution: Install the latest version: * If you use the External Links Filter module for Drupal 7.x, upgrade to External Links Filter version 7.x-3.1 [3] * If you use the External Links Filter module for Drupal 8.x, upgrade to External Links Filter version 8.x-1.2 [4] Also see the External Links Filter [5] project page. Reported By: * Manuel Adán [6] Fixed By: * Manuel Adán [7] * Dmitry Drozdik [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/elf [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/elf/releases/7.x-3.1 [4] https://www.drupal.org/project/elf/releases/8.x-1.2 [5] https://www.drupal.org/project/elf [6] https://www.drupal.org/user/516420 [7] https://www.drupal.org/user/516420 [8] https://www.drupal.org/user/574124 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/36762

1 0

Super Login - Moderately critical - Cross site scripting - SA-CONTRIB-2019-062
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-062 Project: Super Login [1] Date: 2019-August-14 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module improves the Drupal login page with the new features and layout. The module doesn't sufficiently filter input text in the administration pages text configuration inputs. For example, the login text field. The vulnerability is mitigated by the fact it can only be exploited by a user with the "Administer super login" permission. Solution: Install the latest version: * If you use the Super Login module for Drupal 8.x, upgrade to Super Login 8.x-1.3 [3] * If you use the Super Login module for Drupal 7.x, upgrade to Super Login 7.x-1.4 [4] Also see the Super Login [5] project page. Reported By: * Mitch Portier [6] Fixed By: * Mitch Portier [7] * Shawn Ostermann [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/super_login [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/super_login/releases/8.x-1.3 [4] https://www.drupal.org/project/super_login/releases/7.x-1.4 [5] https://www.drupal.org/project/super_login [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/2284182 [8] https://www.drupal.org/user/61221 [9] https://www.drupal.org/user/36762

1 0

scroll to top - Moderately critical - Cross site scripting - SA-CONTRIB-2019-061
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-061 Project: scroll to top [1] Date: 2019-August-14 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: The Scroll To Top module enables you to have an animated scroll to top link in the bottom of the node. The module does not sufficiently filter configuration text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer scroll to top". Solution: Install the latest version of the module. * If you use the Scroll To Top module for Drupal 7.x, upgrade to Scroll To Top 7.x-2.2 [3] Also see the scroll to top [4] project page. Reported By: * Ayesh Karunaratne [5] * Yonatan Offek [6] Fixed By: * Ayesh Karunaratne [7] * Tarek Djebali [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/scroll_to_top [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/scroll_to_top/releases/7.x-2.2 [4] https://www.drupal.org/project/scroll_to_top [5] https://www.drupal.org/user/796148 [6] https://www.drupal.org/user/194009 [7] https://www.drupal.org/user/796148 [8] https://www.drupal.org/user/745218 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/36762

1 0

Existing Values Autocomplete Widget - Critical - Access bypass - SA-CONTRIB-2019-060
by security-news＠drupal.org 24 Jul '19

24 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-060 Project: Existing Values Autocomplete Widget [1] Date: 2019-July-24 Security risk: *Critical* 17∕25 AC:None/A:None/CI:All/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module provides an autocomplete widget for text fields that suggests all existing (previously entered) values for that field. The module doesn't sufficiently check for proper access permission before returning autocomplete results. This vulnerability is mitigated by the fact that an attacker must know the route to the autocomplete callback controller though this is easily known. Solution: Install the latest version: * If you use the Existing Values Autocomplete Widget module for Drupal 8.x, upgrade to Existing Values Autocomplete Widget 8.x-1.2 [3] Also see the Existing Values Autocomplete Widget [4] project page. Reported By: * David Stinemetze [5] Fixed By: * Art Williams [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/existing_values_autocomplete_widget [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3069768 [4] https://www.drupal.org/project/existing_values_autocomplete_widget [5] https://www.drupal.org/user/2508346 [6] https://www.drupal.org/user/77599 [7] https://www.drupal.org/user/102818 [8] https://www.drupal.org/user/36762

1 0

Facebook Messenger Customer Chat Plugin - Critical - Access bypass - SA-CONTRIB-2019-059
by security-news＠drupal.org 24 Jul '19

24 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-059 Project: Facebook Messenger Customer Chat Plugin [1] Date: 2019-July-24 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The Facebook Messenger Customer Chat Plugin module enables you to add the Facebook Messenger Customer Chat Plugin to your Drupal site. The module doesn't require user permissions on the admin page. Solution: Install the latest version: * If you use the Facebook Messenger Customer Chat Plugin module for Drupal 7.x, upgrade to Facebook Messenger Customer Chat Plugin 7.x-1.1 [3] Also see the Facebook Messenger Customer Chat Plugin [4] project page. Reported By: -------- REPORTED BY --------------------------------------------------------- * Marcelo Vani [5] Fixed By: * Marcelo Vani [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/fb_messenger_customer_chat_plugin [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/fb_messenger_customer_chat_plugin/releases/7… [4] https://www.drupal.org/project/fb_messenger_customer_chat_plugin [5] https://www.drupal.org/user/854220 [6] https://www.drupal.org/user/854220 [7] https://www.drupal.org/user/102818 [8] https://www.drupal.org/user/36762

1 0