SA-CONTRIB-2010-068 - Masquerade - Cross Site Request Forgery - Security-news

23 Jun 2010


      * Advisory ID: DRUPAL-SA-CONTRIB-2010-068
  * Project: Masquerade (third-party module)
  * Version: 5.x, 6.x
  * Date: 2010-June-23
  * Security risk: Not critical
  * Exploitable from: Remote
  * Vulnerability: Cross Site Request Forgery
-------- DESCRIPTION  
---------------------------------------------------------
The masquerade module is designed as a tool for site designers and
administrators, allowing a user with the right permissions to temporarily
masquerade as another user. The module is vulnerable to Cross Site Request
Forgeries (CSRF [1]) via the masquerade/switch and masquerade/unswitch paths.
-------- VERSIONS AFFECTED  
---------------------------------------------------
* The unsupported Masquerade module for Drupal 5.x versions
  * Masquerade module for Drupal 6.x versions prior to 6.x-1.4
Drupal core is not affected. If you do not use the contributed Masquerade [2]
module, there is nothing you need to do.
-------- SOLUTION  
------------------------------------------------------------
Install the latest version:
  * If you use the unsupported Masquerade module for Drupal 5.x, either
    disable the module or upgrade to the latest 6.x versions of Drupal core
    and the Masquerade module.
  * If you use the Masquerade module for Drupal 6.x upgrade to Masquerade
    6.x-1.4 [3]
See also the Masquerade project page [4].
-------- REPORTED BY  
---------------------------------------------------------
* Ivo Van Geertruyen (mr.baileys [5]) of the Drupal security team
  * Peter Wolanin (pwolanin [6]) of the Drupal security team
-------- FIXED BY  
------------------------------------------------------------
* Andrew Berry (deviantintegral [7]), module co-maintainer
  * Allen Freeman (afreeman [8])
  * Ivo Van Geertruyen (mr.baileys [9]) of the Drupal security team
-------- CONTACT  
-------------------------------------------------------------
The Drupal security team [10] can be reached at security at drupal.org or via
the form at http://drupal.org/contact.
[1] http://en.wikipedia.org/wiki/Csrf
[2] http://drupal.org/project/masquerade
[3] http://drupal.org/node/835692
[4] http://drupal.org/project/Masquerade
[5] http://drupal.org/user/383424
[6] http://drupal.org/user/49851
[7] http://drupal.org/user/71291
[8] http://drupal.org/user/450370
[9] http://drupal.org/user/383424
[10] http://drupal.org/security-team