View online: https://www.drupal.org/node/2877392 * Advisory ID: DRUPAL-SA-CONTRIB-2017-047 * Project: DRD agent [1] (third-party module) * Version: 6.x, 7.x, 8.x * Date: 2017-May-10 * Security risk: 19/25 ( Critical) AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Request Forgery, Open Redirect -------- DESCRIPTION --------------------------------------------------------- The Drupal Remote Dashboard (DRD) module enables you to manage and monitor any remote Drupal site and, this module, the DRD Agent is the remote module which responds to requests from authorised DRD sites. The module doesn't sufficiently protect the URL used to configure itself from CSRF attacks, which could allow a malicious user to craft a special URL that would reconfigure the DRD Agent and redirect to any URL if visited by an admin user. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * DRD Agent 7.x-3.x versions prior to 7.x-3.1. * DRD Agent 8.x-3.x versions prior to 8.x-3.1. Drupal core is not affected. If you do not use the contributed DRD agent [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the DRD Agent module for Drupal 7.x, upgrade to DRD Agent 7.x-3.1 [5] * If you use the DRD Agent module for Drupal 8.x, upgrade to DRD Agent 8.x-3.1 [6] Also see the DRD agent [7] project page. -------- REPORTED BY --------------------------------------------------------- * David Snopek [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Jürgen Haas [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * David Snopek [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/drd_agent [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/drd_agent [5] https://www.drupal.org/node/2877367 [6] https://www.drupal.org/node/2877369 [7] https://www.drupal.org/project/drd_agent [8] https://www.drupal.org/user/266527 [9] https://www.drupal.org/user/168924 [10] https://www.drupal.org/user/266527 [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity