[Security-news] Flag - Moderately Critical - Access Bypass - SA-CONTRIB-2016-050

Wed Aug 31 17:43:13 UTC 2016

View online: https://www.drupal.org/node/2793115

   * Advisory ID: DRUPAL-SA-CONTRIB-2016-050
   * Project: Flag [1]     (third-party module)
   * Version: 7.x
   * Date: 2016-August-31
   * Security risk: 12/25 ( Moderately Critical)
     AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2]
   * Vulnerability: Information Disclosure

-------- DESCRIPTION
---------------------------------------------------------

Flag enables users to mark content with any number of admin-defined flags,
such as 'bookmarks' or 'spam'. Flag Bookmark is a submodule within Flag,
which provides a 'bookmarks' flag, and default views to list bookmarked
content.

The provided view that lists each user's bookmarked content as a tab on their
user profile has for its access control the permission to use the 'bookmarks'
flag. This means that any user who has permission to use the 'bookmarks' flag
can see the list of content that any user has bookmarked.

This vulnerability is mitigated by the fact that the site must have enabled
the Flag Bookmark module to create this view, and an attacker must have a
role with the permission "Flag node entities as bookmarks".

-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [3] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * Flag 7.x-3.x versions prior to 7.x-3.8.

Drupal core is not affected. If you do not use the contributed Flag [4]
module, there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

   * If you use the Flag module for Drupal 7.x, upgrade to Flag 7.x-3.8 [5]

If you have Flag Bookmark enabled, or have enabled it in the past and still
have the flag_bookmarks_tab view active, edit this and change the User: uid
contextual filter's as follows:

   1) set the validator to 'Current user ID matches argument value'
   2) set the action to take if the filter value does not validate to 'Show
      "Page not found"'.

Also see the Flag [6] project page.

-------- REPORTED BY
---------------------------------------------------------

   * Dave Long [7]

-------- FIXED BY
------------------------------------------------------------

   * Joachim Noreiko [8], the module maintainer
   * Dave Long [9]

-------- COORDINATED BY
------------------------------------------------------

   * Lee Rowlands [10] of the Drupal Security Team
   * Michael Hess [11] of the Drupal Security Team
   * Mori Sugimoto [12] of the Drupal Security Team
   * Rick Manelius [13] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at https://www.drupal.org/contact [14].

Learn more about the Drupal Security team and their policies [15], writing
secure code for Drupal [16], and  securing your site [17].

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [18]

[1] https://www.drupal.org/project/flag
[2] https://www.drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] https://www.drupal.org/project/flag
[5] https://www.drupal.org/node/2793073
[6] https://www.drupal.org/project/flag
[7] https://www.drupal.org/user/246492
[8] https://www.drupal.org/user/107701
[9] https://www.drupal.org/user/246492
[10] https://www.drupal.org/user/395439
[11] https://www.drupal.org/user/102818
[12] https://www.drupal.org/user/82971
[13] https://www.drupal.org/user/680072
[14] https://www.drupal.org/contact
[15] https://www.drupal.org/security-team
[16] https://www.drupal.org/writing-secure-code
[17] https://www.drupal.org/security/secure-configuration
[18] https://twitter.com/drupalsecurity