[Security-news] SA-CONTRIB-2011-030 - Devel - Cross Site Request Forgery

[security-news at drupal.org]

  * Advisory ID: SA-CONTRIB-2011-030
  * Project: Devel [1] (third-party module)
  * Version: 6.x, 7.x
  * Date: 2011-July-20
  * Security risk: Not critical [2]
  * Exploitable from: Remote
  * Vulnerability: Cross Site Request Forgery

-------- DESCRIPTION  
---------------------------------------------------------

The devel module is designed as a tool to accelerate Drupal software
development. One of its features enables a highly permissioned developer to
quickly switch to another user's account, without providing credentials.

The module is vulnerable to Cross Site Request Forgeries (CSRF) via the links
and form in the Switch User block.

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * 6.x-1.24 and prior
  * 7.x-1.0 and prior

Note: prior versions are no longer maintained by the security team.

Drupal core is not affected. If you do not use the contributed Devel module,
there is nothing you need to do.

Drupal core is not affected. If you do not use the contributed Devel [3]
module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the Devel module for Drupal 7.x upgrade to Devel 7.x-1.1 [4]
  * If you use the Devel module for Drupal 6.x upgrade to Devel 6.x-1.25 [5]

See also the Devel project page [6].

See also the Devel [7] project page.

-------- REPORTED BY  
---------------------------------------------------------

The vulnerability was reported independently by:

  * Dylan Wilder-Tack (grendzy) [8] of the Drupal Security Team
  * Andrew Berry (deviantintegral) [9]

-------- FIXED BY  
------------------------------------------------------------

  * Hans Salvisberg (salvis [10]) the module co-maintainer.
  * Moshe Weitzman [11] module maintainer and member of the Drupal Security
    Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [12].

Learn more about the Drupal Security team and their policies [13], writing
secure code for Drupal [14], and securing your site [15].


[1] http://drupal.org/project/devel
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/devel
[4] http://drupal.org/node/1224846
[5] http://drupal.org/node/1224842
[6] http://drupal.org/project/devel
[7] http://drupal.org/project/devel
[8] http://drupal.org/user/96647
[9] http://drupal.org/user/71291
[10] http://drupal.org/user/82964
[11] http://drupal.org/user/23
[12] http://drupal.org/contact
[13] http://drupal.org/security-team
[14] http://drupal.org/writing-secure-code
[15] http://drupal.org/security/secure-configuration