[Security-news] SA-CONTRIB-2012-118 - Secure Login - Open Redirect

[security-news at drupal.org]

View online: http://drupal.org/node/1700594

  * Advisory ID: DRUPAL-SA-CONTRIB-2012-118
  * Project: Secure Login [1] (third-party module)
  * Version: 7.x
  * Date: 2012-July-25
  * Security risk: Less critical [2]
  * Exploitable from: Remote
  * Vulnerability: Open Redirect

-------- DESCRIPTION  
---------------------------------------------------------

Secure Login module enables the user login and other forms to be submitted
securely via HTTPS, thus preventing passwords and other private user data
from being transmitted in clear text. In addition, Secure Login module by
default redirects non-HTTPS GET requests for pages containing forms that it
secures to the HTTPS site.

The module does not sufficiently validate that a requested path is internal
to the site, allowing an attacker to disguise a malicious destination address
as a GET query parameter passed to a non-HTTPS site URL.

This vulnerability is mitigated by the fact that the target site must render
a form secured by Secure Login module on its 404 page, such as in a block. A
default installation of Drupal 7 renders the user login block on the 404
page, and is thus vulnerable to the open redirect.

CVE: Requested

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Secure Login 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Secure Login
[3] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the Secure Login module for Drupal 7.x, upgrade to Secure Login
    7.x-1.3 [4].

Also see the Secure Login [5] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Albert Martin [6]

-------- FIXED BY  
------------------------------------------------------------

  * Mark Burdett [7], the module maintainer

-------- COORDINATED BY  
------------------------------------------------------

  * Heine Deelstra [8] of the Drupal Security Team
  * Greg Knaddison [9] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [10].

Learn more about the Drupal Security team and their policies [11], writing
secure code for Drupal [12], and securing your site [13].


[1] http://drupal.org/project/securelogin
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/securelogin
[4] https://drupal.org/node/1698988
[5] http://drupal.org/project/securelogin
[6] https://drupal.org/user/1888132
[7] https://drupal.org/user/12302
[8] http://drupal.org/user/17943
[9] http://drupal.org/user/36762
[10] http://drupal.org/contact
[11] http://drupal.org/security-team
[12] http://drupal.org/writing-secure-code
[13] http://drupal.org/security/secure-configuration