[Security-news] Xsendfile - Moderately critical - Access bypass - SA-CONTRIB-2023-053

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2023-053

Project: Xsendfile [1]
Date: 2023-November-29
Security risk: *Moderately critical* 13∕25
AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Affected versions: <1.2.0
Description: 
The Xsendfile module enables fast transfer for private files in Drupal.

In order to control private file downloads, the module overrides
ImageStyleDownloadController, for which a vulnerability was disclosed in
SA-CORE-2023-005 [3]. The Xsendfile module was still based on an insecure
version of ImageStyleDownloadController.

Solution: 
Install the latest version:

   * If you use the Xsendfile module for Drupal 8.x, upgrade to Xsendfile
     8.x-1.2. [4]

Reported By: 
   * Pierre Rudloff [5]

Fixed By: 
   * Damien Norris [6]
   * Bruno De Bondt [7]
   * Pierre Rudloff [8]
   * Conrad Lara [9]

Coordinated By: 
   * Greg Knaddison [10] of the Drupal Security Team


[1] https://www.drupal.org/project/xsendfile
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/sa-core-2023-005
[4] https://www.drupal.org/project/xsendfile/releases/8.x-1.2
[5] https://www.drupal.org/user/3611858
[6] https://www.drupal.org/user/97688
[7] https://www.drupal.org/user/33235
[8] https://www.drupal.org/user/3611858
[9] https://www.drupal.org/user/1790054
[10] https://www.drupal.org/user/36762