[Security-news] SA-CONTRIB-2013-079 - Context - Mulitple Vulnerabilities

[security-news at drupal.org]

View online: https://drupal.org/node/2113317

  * Advisory ID: DRUPAL-SA-CONTRIB-2013-079
  * Project: Context [1] (third-party module)
  * Version: 6.x, 7.x
  * Date: 2013-2013-16
  * Security risk: Highly critical [2]
  * Exploitable from: Remote
  * Vulnerability: Access bypass, Arbitrary PHP code execution

-------- DESCRIPTION  
---------------------------------------------------------

Context allows you to manage contextual conditions and reactions for
different portions of your site

This advisory covers two separate issues. The first, and more severe issue
(Highly Critical status), is that the module allows execution of PHP code via
manipulation of a URL argument in a path used for AJAX operations when
running in a configuration without a json_decode function provided by PHP or
the PECL JSON library.

This vulnerability is mitigated by the fact that the server must be running a
version of PHP prior to 5.2 that does not have the json library installed
(PHP 5.2+ come bundled with the JSON library).

The second, less severe issue (Less Critical status), is that Context uses
Drupal's token scheme to restrict access to the json rendering of a block.
This control mechanism is insufficient as Drupal's token scheme is designed
to provide security between two different sessions (or a session and a non
authenticated user) and is not designed to provide security within a session.
This means that a user with access to block A may be able to use the
information about block A and the resulting token in order to generate the
correct token for accessing block B to which they should not have access.

The vulnerability is mitigated by needing blocks that have sensitive
information (for example, custom blocks with private information or a list of
unpublished nodes.)


-------- CVE IDENTIFIER(S) ISSUED  
--------------------------------------------

  * /A CVE identifier [3] will be requested, and added upon issuance, in
    accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * 6.x-2.x versions prior to 6.x-3.2.
  * 7.x-3.x versions prior to 7.x-3.0.

Drupal core is not affected. If you do not use the contributed Context [4]
module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Remote code execution can be resolved by any of

  * Upgrading your PHP to 5.2+
  * Installing the JSON package [5].
  * Upgrading context to 6.x-3.2 [6] or 7.x-3.0 [7]

Block access issue can be resolved by upgrading context to 6.x-3.2 [8] or
7.x-3.0 [9].

Also see the Context [10] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Heine [11] of the Drupal Security Team

-------- FIXED BY  
------------------------------------------------------------

  * Hunter [12] of the Drupal Security Team, a module maintainer
  * Heine [13] of the Drupal Security Team
  * tekante [14] a module maintainer

-------- COORDINATED BY  
------------------------------------------------------

  * Hunter [15] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [16].

Learn more about the Drupal Security team and their policies [17], writing
secure code for Drupal [18], and securing your site [19].


[1] http://drupal.org/project/context
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] http://drupal.org/project/context
[5] http://pecl.php.net/package/json
[6] https://drupal.org/node/2112791
[7] https://drupal.org/node/2112785
[8] https://drupal.org/node/2112791
[9] https://drupal.org/node/2112785
[10] http://drupal.org/project/context
[11] http://drupal.org/user/17943
[12] http://drupal.org/user/426416
[13] http://drupal.org/user/17943
[14] http://drupal.org/user/640024
[15] http://drupal.org/user/426416
[16] http://drupal.org/contact
[17] http://drupal.org/security-team
[18] http://drupal.org/writing-secure-code
[19] http://drupal.org/security/secure-configuration