[Security-news] PRLP - Critical - Access Bypass and Privilege Escalation - SA-CONTRIB-2017-030

[security-news at drupal.org]

View online: https://www.drupal.org/node/2858880

   * Advisory ID: DRUPAL-SA-CONTRIB-2017-030
   * Project: Password Reset Landing Page (PRLP) [1]     (third-party module)
   * Version: 8.x
   * Date: 2017-March-08
   * Security risk: 16/25 ( Critical)
     AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2]
   * Vulnerability: Access bypass, Privilege escalation

-------- DESCRIPTION
---------------------------------------------------------

This module adds a form on the password-reset-landing page to allow changing
the password of the user during the log in process.

The module does not sufficiently validate all access tokens, which allows an
attacker to change the password of any arbitrary user and gain access to
their account.

In order to exploit, the attacker must have an active account on the site.


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [3] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * PRLP versions prior to 8.x-1.3

Drupal core is not affected. If you do not use the contributed Password Reset
Landing Page (PRLP) [4] module, there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

   * If you use the PRLP module for Drupal 8.x, upgrade to PRLP 8.x-1.3 [5]
     (the latest 8.x release as of this advisory date).

Also see the Password Reset Landing Page (PRLP) [6] project page.

-------- REPORTED BY
---------------------------------------------------------

   * Renaud CUNY [7]

-------- FIXED BY
------------------------------------------------------------

   * Jitesh Doshi [8] the module maintainer

-------- COORDINATED BY
------------------------------------------------------

   * Greg Knaddison [9] of the Drupal Security Team
   * Michael Hess [10] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at https://www.drupal.org/contact [11].

Learn more about the Drupal Security team and their policies [12], writing
secure code for Drupal [13], and  securing your site [14].

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [15]


[1] https://www.drupal.org/project/prlp
[2] https://www.drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] https://www.drupal.org/project/prlp
[5] https://www.drupal.org/project/prlp/releases/8.x-1.3
[6] https://www.drupal.org/project/prlp
[7] https://www.drupal.org/u/renaudcuny
[8] https://www.drupal.org/user/1799550
[9] https://www.drupal.org/u/greggles
[10] https://www.drupal.org/u/mlhess
[11] https://www.drupal.org/contact
[12] https://www.drupal.org/security-team
[13] https://www.drupal.org/writing-secure-code
[14] https://www.drupal.org/security/secure-configuration
[15] https://twitter.com/drupalsecurity