[Security-news] Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2024-052

Project: Monster Menus [1]
Date: 2024-October-23
Security risk: *Critical* 19 ∕ 25
AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:All [2]
Vulnerability: Arbitrary PHP code execution

Affected versions: <9.3.4 || >=9.4.0 <9.4.2
Description: 
This module enables you to group nodes within pages that have a
highly-granular, distributed permissions structure.

In certain cases the module doesn't sufficiently sanitize data before passing
it to PHP's unserialize() function, which can result in arbitrary code
execution.

Solution: 
Install the latest version:

   * If you use Monster Menus branch *9.4.x*, upgrade to monster_menus 9.4.2
     [3]
   * If you use Monster Menus branch *9.3.x*, upgrade to monster_menus 9.3.4
     [4]

Reported By: 
   * Drew Webber [5] of the Drupal Security Team

Fixed By: 
   * Drew Webber [6] of the Drupal Security Team
   * Dan Wilga [7]

Coordinated By: 
   * Greg Knaddison [8] of the Drupal Security Team
   * Juraj Nemec [9] of the Drupal Security Team
   * Drew Webber [10] of the Drupal Security Team


[1] https://www.drupal.org/project/monster_menus
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/monster_menus/releases/9.4.2
[4] https://www.drupal.org/project/monster_menus/releases/9.3.4
[5] https://www.drupal.org/user/255969
[6] https://www.drupal.org/user/255969
[7] https://www.drupal.org/user/56892
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/poker10
[10] https://www.drupal.org/user/255969