[Security-news] Ctools - Critical - Multiple Vulnerabilities - SA-CONTRIB-2015-141

Wed Aug 19 21:34:09 UTC 2015

View online: https://www.drupal.org/node/2554145

   * Advisory ID: DRUPAL-SA-CONTRIB-2015-141
   * Project: Chaos tool suite (ctools) [1]     (third-party module)
   * Version: 6.x, 7.x
   * Date: 2015-August-19
   * Security risk: 14/25 ( Moderately Critical)
     AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2]
   * Vulnerability: Cross Site Scripting, Access bypass, Multiple
     vulnerabilities

-------- DESCRIPTION
---------------------------------------------------------

.... Cross Site Scripting (XSS)

Ctools in Drupal 6 provides a number of APIs and extensions for Drupal, and
is a dependency for many of the most popular modules, including Views, Panels
and Entityreference. Many features introduced in Drupal Core once lived in
ctools.

This vulnerability can be mitigated by the fact that ctools must load its
javascript on the page and the user has access to submit data through a form
(such as a comment or node) that allows 'a' tags.

This patch is a backport for SA-CORE-2015-003 [3].

.... Access bypass

This module provides a number of APIs and extensions for Drupal, and is a
dependency for many of the most popular modules, including Views, Panels and
Features.

The module doesn't sufficiently verify the "edit" permission for the "content
type" plugins that are used on Panels and similar systems to place content
and functionality on a page.

This vulnerability is mitigated by the fact that the user must have access to
edit a display via a Panels display system, e.g. via Panels pages, Mini
Panels, Panel Nodes, Panelizer displays, IPE, Panels Everywhere, etc.
Furthermore, either a contributed module provides a CTools content type
plugin, or a custom plugin must be written that inherits permissions from
another plugin and must have a different permission defined; if no "edit"
permission is set up for the child object CTools did not check the
permissions of the parent object. One potential scenario would allow people
who did not have edit access to Fieldable Panels Panes panes, which were
specifically set to not be reusable, to edit them despite the person's lack
of access.

-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [4] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

Cross Site Scripting:

   * ctools 6.x-1.x versions prior to 6.x-1.14.

Access bypass:

   * ctools 6.x-1.x versions prior to 6.x-1.14.
   * ctools 7.x-1.x versions prior to 7.x-1.8.

Drupal core is not affected. If you do not use the contributed Chaos tool
suite (ctools) [5] module, there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

   * If you use the ctools module for Drupal 6.x, upgrade to ctools 6.x-1.14
     [6]
   * If you use the ctools module for Drupal 7.x, upgrade to ctools 7.x-1.8 
[7]

Also see the Chaos tool suite (ctools) [8] project page.

-------- REPORTED BY
---------------------------------------------------------

Cross Site Scripting:

   * Peter Wolanin [9] of the Drupal Security Team

Access bypass:

   * Andor Dávid [10]

-------- FIXED BY
------------------------------------------------------------

Cross Site Scripting:

   * James Gilliland [11] of the Drupal Security Team
   * Alex Bronstein [12], Drupal core patch coordinator
   * Kris Vanderwater [13] the module maintainer
   * Jakob Perry [14] the module maintainer

Access bypass:

   * Andor Dávid [15]
   * Damien McKenna [16], provisional member of the Drupal Security Team
   * Michael Miles [17] of the Drupal Security Team
   * Jakob Perry [18] the module maintainer

-------- COORDINATED BY
------------------------------------------------------

   * Pere Orga [19] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at https://www.drupal.org/contact [20].

Learn more about the Drupal Security team and their policies [21], writing
secure code for Drupal [22], and  securing your site [23].

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [24]

[1] https://www.drupal.org/project/ctools
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/SA-CORE-2015-003
[4] http://cve.mitre.org/
[5] https://www.drupal.org/project/ctools
[6] https://www.drupal.org/node/2554133
[7] https://www.drupal.org/node/2554141
[8] https://www.drupal.org/project/ctools
[9] https://www.drupal.org/u/pwolanin
[10] https://www.drupal.org/u/sweetchuck
[11] https://www.drupal.org/u/neclimdul
[12] https://www.drupal.org/user/78040
[13] https://www.drupal.org/user/61203
[14] https://www.drupal.org/user/45640
[15] https://www.drupal.org/u/sweetchuck
[16] https://www.drupal.org/u/damienmckenna
[17] https://www.drupal.org/u/mikemiles86
[18] https://www.drupal.org/u/japerry
[19] https://www.drupal.org/user/2301194
[20] https://www.drupal.org/contact
[21] https://www.drupal.org/security-team
[22] https://www.drupal.org/writing-secure-code
[23] https://www.drupal.org/security/secure-configuration
[24] https://twitter.com/drupalsecurity