* Advisory ID: SA-CONTRIB-2011-030 * Project: Devel [1] (third-party module) * Version: 6.x, 7.x * Date: 2011-July-20 * Security risk: Not critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery
-------- DESCRIPTION ---------------------------------------------------------
The devel module is designed as a tool to accelerate Drupal software development. One of its features enables a highly permissioned developer to quickly switch to another user's account, without providing credentials.
The module is vulnerable to Cross Site Request Forgeries (CSRF) via the links and form in the Switch User block.
-------- VERSIONS AFFECTED ---------------------------------------------------
* 6.x-1.24 and prior * 7.x-1.0 and prior
Note: prior versions are no longer maintained by the security team.
Drupal core is not affected. If you do not use the contributed Devel module, there is nothing you need to do.
Drupal core is not affected. If you do not use the contributed Devel [3] module, there is nothing you need to do.
-------- SOLUTION ------------------------------------------------------------
Install the latest version:
* If you use the Devel module for Drupal 7.x upgrade to Devel 7.x-1.1 [4] * If you use the Devel module for Drupal 6.x upgrade to Devel 6.x-1.25 [5]
See also the Devel project page [6].
See also the Devel [7] project page.
-------- REPORTED BY ---------------------------------------------------------
The vulnerability was reported independently by:
* Dylan Wilder-Tack (grendzy) [8] of the Drupal Security Team * Andrew Berry (deviantintegral) [9]
-------- FIXED BY ------------------------------------------------------------
* Hans Salvisberg (salvis [10]) the module co-maintainer. * Moshe Weitzman [11] module maintainer and member of the Drupal Security Team
-------- CONTACT AND MORE INFORMATION ----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12].
Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15].
[1] http://drupal.org/project/devel [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/devel [4] http://drupal.org/node/1224846 [5] http://drupal.org/node/1224842 [6] http://drupal.org/project/devel [7] http://drupal.org/project/devel [8] http://drupal.org/user/96647 [9] http://drupal.org/user/71291 [10] http://drupal.org/user/82964 [11] http://drupal.org/user/23 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration