[Security-news] SA-CONTRIB-2013-095 - Organic Groups - Access bypass

[security-news at drupal.org]

View online: https://drupal.org/node/2140217

   * Advisory ID: DRUPAL-SA-CONTRIB-2013-095
   * Project: Organic groups [1] (third-party module)
   * Version: 7.x
   * Date: 2013-November-20
   * Security risk: Moderately critical [2]
   * Exploitable from: Remote
   * Vulnerability: Access bypass

-------- DESCRIPTION
---------------------------------------------------------

Two issues exist within entity references and permissions relating to OG,
allowing users potential access bypass.

.... Posting content into groups where a user is not a member

Organic Groups does not sufficiently check the group audience fields (e.g.
og_group_ref) field from being populated with invalid data. The autocomplete
reference field only needs a node id to validate.

An attacker could modify a group audience field in order to post within a
group they had no access.

Any user with the ability to create content can use this vulnerability.

.... Inconsistent access checking in posting content

Organic Groups manages its own group based permissions. This allows users to
have escalated privileges sets in specific groups, but not site-wide. Organic
Groups makes the assumption that the group field is populated and when this
not populated, a user may have permission to create or edit content outside
of a group even though they shouldn't be allowed to do that.

This vulnerability is mitigated because the following must be true in order
for it to work:
1) The node in question must have all of its groups be set as optional input
2) The user must not have site-wide access to post content of a certain type,
but also a member of a group that does permit create/edit privileges to the
same type.


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [3] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * OG 7.x-2.x versions prior to 7.x-2.3

Drupal core is not affected. If you do not use the contributed Organic groups
[4] module, there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

   * If you use the Organic Groups module for Drupal 7.x, upgrade to og  
7.x-2.4
     [5]

Also see the Organic groups [6] project page.

-------- REPORTED BY
---------------------------------------------------------

   * Jakob Perry [7]
   * Richard Goodrow [8]
   * Bruce Hoppe [9]

-------- FIXED BY
------------------------------------------------------------

   * Amitai Burstein [10] the module maintainer
   * Roy Segall [11]
   * Jakob Perry [12]

-------- COORDINATED BY
------------------------------------------------------

   * David Stoline [13] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [14].

Learn more about the Drupal Security team and their policies [15], writing
secure code for Drupal [16], and securing your site [17].


[1] http://drupal.org/project/og
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] http://drupal.org/project/og
[5] http://drupal.org/node/2140209
[6] http://drupal.org/project/og
[7] http://drupal.org/user/45640
[8] http://drupal.org/user/802140
[9] http://drupal.org/user/2470954
[10] https://drupal.org/user/57511
[11] https://drupal.org/user/1812910
[12] http://drupal.org/user/45640
[13] https://drupal.org/user/329570
[14] http://drupal.org/contact
[15] http://drupal.org/security-team
[16] http://drupal.org/writing-secure-code
[17] http://drupal.org/security/secure-configuration