* Advisory ID: DRUPAL-SA-CONTRIB-2012-056 * Project: Janrain Engage (formerly RPX) [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-April-04 * Security risk: Less critical [2] * Exploitable from: Not exploitable * Vulnerability: Sensitive Data Protection Vulnerability -------- DESCRIPTION --------------------------------------------------------- Using Janrain Engage, Drupal sites can authenticate new and existing users with popular social networks, map user profile data from these websites to Drupal fields, and share Drupal content with a user's friends on their social networks. The module permanently retains the complete user profile data returned from Engage in the users table. Only a subset of that data is needed for a limited time. The profile data is also stored in the sessions table. This is undesirable as it may include sensitive information (such as provider access tokens). This is not an immediate vulnerability per se as it does not create an attack vector (i.e. it cannot be exploited) but it makes other weaknesses much more critical (e.g. a data breach could be parlayed into privilege escalation). -------- VERSIONS AFFECTED --------------------------------------------------- * Janrain Engage (formerly RPX) 6.x-1.x versions (all). * Janrain Engage (formerly RPX) 6.x-2.x versions prior to 6.x-2.2. * Janrain Engage (formerly RPX) 7.x-2.x versions prior to 7.x-2.2. Drupal core is not affected. If you do not use the contributed Janrain Engage (formerly RPX) [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Janrain Engage (formerly RPX) for Drupal 6.x, upgrade to version 6.x-2.2 [4] * If you use Janrain Engage (formerly RPX) for Drupal 7.x, upgrade to version 7.x-2.2 [5] Also see the Janrain Engage (formerly RPX) [6] project page. -------- REPORTED BY --------------------------------------------------------- * Peter Wolanin [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * George Katsitadze [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Peter Wolanin [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/rpx [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/rpx [4] http://drupal.org/node/1515114 [5] http://drupal.org/node/1515120 [6] http://drupal.org/project/rpx [7] http://drupal.org/user/49851 [8] http://drupal.org/user/933066 [9] http://drupal.org/user/49851 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration