[Security-news] Services - Less critical - Access bypass - SA-CONTRIB-2019-043

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2019-043

Project: Services [1]
Version: 7.x-3.x-dev
Date: 2019-April-03
Security risk: *Less critical* 9∕25
AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass

Description: 
This module provides a standardized solution for building API's so that
external clients can communicate with Drupal.

The Services module has an access bypass vulnerability in its "attach_file"
resource that allows users who have access to create or update nodes that
include file fields to arbitrarily reference files they do not have access
to, which can expose private files.

This vulnerability is mitigated by the fact that an attacker must have a role
with permission to create or edit a node.

Solution: 
Install the latest version:

   * If you use the Services module for Drupal 7.x, upgrade to Services
     7.x-3.24 [3]

Also see the Services [4] project page.

Reported By: 
   * Samuel Mortenson  [5] of the Drupal Security Team

Fixed By: 
   * Tyler Frankenstein  [6]

Coordinated By: 
   * Samuel Mortenson  [7] of the Drupal Security Team
   * Greg Knaddison [8] of the Drupal Security Team


[1] https://www.drupal.org/project/services
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/services/releases/7.x-3.24
[4] https://www.drupal.org/project/services
[5] https://www.drupal.org/user/2582268
[6] https://www.drupal.org/user/150680
[7] https://www.drupal.org/user/2582268
[8] https://www.drupal.org/user/36762