Core Security Advisories

Subscribe to Core Security Advisories feed
Updated: 1 hour 6 min ago

SA-CORE-2013-002 - Drupal core - Denial of service

Wed, 02/20/2013 - 3:50pm
  • Advisory ID: DRUPAL-SA-CORE-2013-002
  • Project: Drupal core
  • Version: 7.x
  • Date: 2013-February-20
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Denial of service
Description

Drupal core's Image module allows for the on-demand generation of image derivatives. This capability can be abused by requesting a large number of new derivatives which can fill up the server disk space, and which can cause a very high CPU load. Either of these effects may lead to the site becoming unavailable or unresponsive.

Please see the Drupal 7.20 release notes for important notes about the changes which were made to fix this issue, since some sites will require extra testing and care when deploying this Drupal core release.

CVE identifier(s) issued
  • CVE-2013-0316
Versions affected
  • Drupal core 7.x versions prior to 7.20.
Solution

Install the latest version:

Also see the Drupal core project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 6.xDrupal 7.x

SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities

Wed, 01/16/2013 - 5:07pm
  • Advisory ID: DRUPAL-SA-CORE-2013-001
  • Project: Drupal core
  • Version: 6.x, 7.x
  • Date: 2013-January-16
  • Security risk: Highly critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting, Access bypass
Description

Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7.

Cross-site scripting (Various core and contributed modules - Drupal 6 and 7)

A reflected cross-site scripting vulnerability (XSS) was identified in certain Drupal JavaScript functions that pass unexpected user input into jQuery causing it to insert HTML into the page when the intended behavior is to select DOM elements. Multiple core and contributed modules are affected by this issue.

jQuery versions 1.6.3 and higher provide protection against common forms of this problem; thus, the vulnerability is mitigated if your site has upgraded to a recent version of jQuery. However, the versions of jQuery that are shipped with Drupal 6 and Drupal 7 core do not contain this protection.

Although the fix added to Drupal as part of this security release prevents the most common forms of this issue in the same way as newer versions of jQuery do, developers should be aware that passing untrusted user input directly to jQuery functions such as jQuery() and $() is unsafe and should be avoided.

CVE: CVE-2013-0244 (a CVE was also separately issued for jQuery)

Access bypass (Book module printer friendly version - Drupal 6 and 7)

A vulnerability was identified that exposes the title or, in some cases, the content of nodes that the user should not have access to.

This vulnerability is mitigated by the fact that the bypass is only accessible to users who already have the 'access printer-friendly version' permission (which is not granted to Anonymous or Authenticated users by default) and it only affects nodes that are part of a book outline.

CVE: CVE-2013-0245

Access bypass (Image module - Drupal 7)

Drupal core provides the ability to have private files, including images. A vulnerability was identified in which derivative images (which Drupal automatically creates from these images based on "image styles" and which may differ, for example, in size or saturation) did not always receive the same protection. Under some circumstances, this would allow users to access image derivatives for images they should not be able to view.

This vulnerability is mitigated by the fact that it only affects sites which use the Image module and which store images in a private file system.

CVE: CVE-2013-0246

CVE identifier(s) issued
  • CVE-2013-0244
  • CVE-2013-0245
  • CVE-2013-0246
Versions affected
  • Drupal core 6.x versions prior to 6.28.
  • Drupal core 7.x versions prior to 7.19.
Solution

Install the latest version:

Also see the Drupal core project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 6.xDrupal 7.x

SA-CORE-2012-004 - Drupal core - Multiple vulnerabilities

Wed, 12/19/2012 - 1:46pm
  • Advisory ID: DRUPAL-SA-CORE-2012-004
  • Project: Drupal core
  • Version: 6.x, 7.x
  • Date: 2012-December-19
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass, Arbitrary PHP code execution
Description

Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7.

Access bypass (User module search - Drupal 6 and 7)

A vulnerability was identified that allows blocked users to appear in user search results, even when the search results are viewed by unprivileged users.

This vulnerability is mitigated by the fact that the default Drupal core user search results only display usernames (and disclosure of usernames is not considered a security vulnerability). However, since modules or themes may override the search results to display more information from each user's profile, this could result in additional information about blocked users being disclosed on some sites.

Access bypass (Upload module - Drupal 6)

A vulnerability was identified that allows information about uploaded files to be displayed in RSS feeds and search results to users that do not have the "view uploaded files" permission.

This issue affects Drupal 6 only.

Arbitrary PHP code execution (File upload modules - Drupal 6 and 7)

Drupal core's file upload feature blocks the upload of many files that can be executed on the server by munging the filename. A malicious user could name a file in a manner that bypasses this munging of the filename in Drupal's input validation.

This vulnerability is mitigated by several factors: The attacker would need the permission to upload a file to the server. Certain combinations of PHP and filesystems are not vulnerable to this issue, though we did not perform an exhaustive review of the supported PHP versions. Finally: the server would need to allow execution of files in the uploads directory. Drupal core has protected against this with a .htaccess file protection in place from SA-2006-006 - Drupal Core - Execution of arbitrary files in certain Apache configurations. Users of IIS should consider updating their web.config. Users of Nginx should confirm that only the index.php and other known good scripts are executable. Users of other webservers should review their configuration to ensure the goals are achieved in some other way.

CVE identifier(s) issued
  • Access bypass (User module search - Drupal 6 and 7): CVE-2012-5651
  • Access bypass (Upload module - Drupal 6): CVE-2012-5652
  • Arbitrary PHP code execution (File upload modules - Drupal 6 and 7): CVE-2012-5653
Versions affected
  • Drupal core 6.x versions prior to 6.27.
  • Drupal core 7.x versions prior to 7.18.
Solution

Install the latest version:

Also see the Drupal core project page.

Reported by
  • The access bypass issue in the User module search results was reported by Derek Wright of the Drupal Security Team.
  • The access bypass issue in the Drupal 6 Upload module was reported by Simon Rycroft, and by Damien Tournoud of the Drupal Security Team.
  • The arbitrary code execution issue was reported by Amit Asaravala.
Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 6.xDrupal 7.x

SA-CORE-2012-003 - Drupal core - Arbitrary PHP code execution and Information disclosure

Wed, 10/17/2012 - 5:29pm
  • Advisory ID: DRUPAL-SA-CORE-2012-003
  • Project: Drupal core
  • Version: 7.x
  • Date: 2012-October-17
  • Security risk: Highly critical
  • Exploitable from: Remote
  • Vulnerability: Information Disclosure, Arbitrary PHP code execution
Description

Multiple vulnerabilities were discovered in Drupal core.

Arbitrary PHP code execution

A bug in the installer code was identified that allows an attacker to re-install Drupal using an external database server under certain transient conditions. This could allow the attacker to execute arbitrary PHP code on the original server.

This vulnerability is mitigated by the fact that the re-installation can only be successful if the site's settings.php file or sites directories are writeable by or owned by the webserver user. Configuring the Drupal installation to be owned by a different user than the webserver user (and not to be writeable by the webserver user) is a recommended security best practice. However, in all cases the transient conditions expose information to an attacker who accesses install.php, and therefore this security update should be applied to all Drupal 7 sites.

CVE: CVE-2012-4553

Information disclosure - OpenID module

For sites using the core OpenID module, an information disclosure vulnerability was identified that allows an attacker to read files on the local filesystem by attempting to log in to the site using a malicious OpenID server.

CVE: CVE-2012-4554

Versions affected
  • Drupal core 7.x versions prior to 7.16.

Drupal 6 is not affected.

Solution

Install the latest version:

If you are unable to deploy the security release immediately, removing or blocking access to install.php is a sufficient mitigation step for the arbitrary PHP code execution vulnerability.

Also see the Drupal core project page.

Reported by
  • The arbitrary PHP code execution vulnerability was reported by Heine Deelstra and Noam Rathaus working with Beyond Security's SecuriTeam Secure Disclosure Program. Heine Deelstra is also a member of the Drupal Security Team.
  • The information disclosure vulnerability in the OpenID module was reported by Reginaldo Silva.
Fixed by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 7.x

SA-CORE-2012-002 - Drupal core multiple vulnerabilities

Wed, 05/02/2012 - 11:17am
  • Advisory ID: DRUPAL-SA-CORE-2012-002
  • Project: Drupal core
  • Version: 7.x
  • Date: 2012-May-2
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Denial of Service, Access bypass, Unvalidated form redirect
Description Denial of Service

CVE: CVE-2012-1588

Drupal core's text filtering system provides several features including removing inappropriate HTML tags and automatically linking content that appears to be a link. A pattern in Drupal's text matching was found to be inefficient with certain specially crafted strings. This vulnerability is mitigated by the fact that users must have the ability to post content sent to the filter system such as a role with the "post comments" or "Forum topic: Create new content" permission.

Unvalidated form redirect

CVE: CVE-2012-1589

Drupal core's Form API allows users to set a destination, but failed to validate that the URL was internal to the site. This weakness could be abused to redirect the login to a remote site with a malicious script that harvests the login credentials and redirects to the live site. This vulnerability is mitigated only by the end user's ability to recognize a URL with malicious query parameters to avoid the social engineering required to exploit the problem.

Access bypass - forum listing

CVE: CVE-2012-1590

Drupal core's forum lists fail to check user access to nodes when displaying them in the forum overview page. If an unpublished node was the most recently updated in a forum then users who should not have access to unpublished forum posts were still be able to see meta-data about the forum post such as the post title.

Access bypass - private images

CVE: CVE-2012-1591

Drupal core provides the ability to have private files, including images, and Image Styles which create derivative images from an original image that may differ, for example, in size or saturation. Drupal core failed to properly terminate the page request for cached image styles allowing users to access image derivatives for images they should not be able to view. Furthermore, Drupal didn't set the right headers to prevent image styles from being cached in the browser.

Access bypass - content administration

CVE: CVE-2012-2153

Drupal core provides the ability to list nodes on a site at admin/content. Drupal core failed to confirm a user viewing that page had access to each node in the list. This vulnerability only concerns sites running a contributed node access module and is mitigated by the fact that users must have a role with the "Access the content overview page" permission. Unpublished nodes were not displayed to users who only had the "Access the content overview page" permission.

Versions affected
  • Drupal core 7.x versions prior to 7.13.
Solution

Install the latest version:

Also see the Drupal core project page.

Reported by
  • The Denial of Service vulnerability was reported by Jay Wineinger and Lin Clark.
  • The unvalidated form redirect vulnerability was reported by Károly Négyesi of the Drupal Security Team and Katsuhiko Nakanishi.
  • The access bypass in forum listing vulnerability was reported by Glen W.
  • The access bypass for private images vulnerability was reported by frega, Andreas Gonell, Jeremy Meier and Xenza.
  • The access bypass for the content administration vulnerability was reported by Jennifer Hodgdon.
Fixed by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 7.x

SA-CORE-2012-001 - Drupal core multiple vulnerabilities

Wed, 02/01/2012 - 5:06pm
  • Advisory ID: DRUPAL-SA-CORE-2012-001
  • Project: Drupal core
  • Version: 6.x, 7.x
  • Date: 2012-February-01
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass, Cross Site Request Forgery, Multiple vulnerabilities
Description Cross Site Request Forgery vulnerability in Aggregator module

CVE: CVE-2012-0826
An XSRF vulnerability can force an aggregator feed to update. Since some services are rate-limited (e.g. Twitter limits requests to 150 per hour) this could lead to a denial of service.

This issue affects Drupal 6.x and 7.x.

OpenID not verifying signed attributes in SREG and AX

CVE: CVE-2012-0825
A group of security researchers identified a flaw in how some OpenID relying parties implement Attribute Exchange (AX). Not verifying that attributes being passed through AX have been signed could allow an attacker to modify users' information.

This issue affects Drupal 6.x and 7.x.

Access bypass in File module

CVE: CVE-2012-0827
When using private files in combination with certain field access modules, the File module will allow users to download the file even if they do not have access to view the field it was attached to.

This issue affects Drupal 7.x only.

Versions affected
  • Drupal 6.x core prior to 6.23.
  • Drupal 7.x core prior to 7.11.
Solution

Install the latest version:

  • If you use Drupal 6.x upgrade to 6.23
  • If you use Drupal 7.x upgrade to 7.11

See also the Drupal core project page.

Reported by Fixed by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 6.xDrupal 7.x

SA-CORE-2011-003 - Drupal core - Access bypass

Wed, 07/27/2011 - 3:32pm
  • Advisory ID: DRUPAL-SA-CORE-2011-003
  • Project: Drupal core
  • Version: 7.x
  • Date: 2011-July-27
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass
Description

CVE: CVE-2011-2726

Access bypass in private file fields on comments.

Drupal 7 contains two new features: the ability to attach File upload fields to any entity type in the system and the ability to point individual File upload fields to the private file directory.

If a Drupal site is using these features on comments, and the parent node is denied access (either by a node access module or by being unpublished), the file attached to the comment can still be downloaded by non-privileged users if they know or guess its direct URL.

This issue affects Drupal 7.x only.

Versions affected
  • Drupal 7.x before version 7.5.
Solution

Install the latest version:

  • If you are running Drupal 7.x then upgrade to Drupal 7.5 or 7.6 7.7.

The Security Team has released both a pure security update without other bug fixes and a security update combined with other bug fixes and improvements. You can choose to either only include the security update for an immediate fix (which might require less quality assurance and testing) or more fixes and improvements alongside the security fixes by choosing between Drupal 7.5 and Drupal 7.6 7.7. Read the announcement for more information.

See also the Drupal core project page.

Reported by Fixed by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 7.x

SA-CORE-2011-002 - Drupal core - Access bypass

Wed, 06/29/2011 - 8:13pm
  • Advisory ID: DRUPAL-SA-CORE-2011-002
  • Project: Drupal core
  • Version: 7.x
  • Date: 2011-JUNE-29
  • Security risk: Highly critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass
Description

CVE: CVE-2011-2687

Access bypass in node listings

Listings showing nodes but not JOINing the node table show all nodes regardless of restrictions imposed by the node_access system. In core, this affects the taxonomy and the forum subsystem.

This issue only affects sites using a node access module such as content access or forum access. If you do not use any node access system then your site is not affected by this vulnerability. It is still considered a best practice to run the latest release and all site owners are encouraged to upgrade when they can regardless of whether or not they are affected.

Note that fixing this issue in contributed modules requires a backwards-compatible API change for modules listing nodes. See http://drupal.org/node/1204572 for more details.

This issue affects Drupal 7.x only.

Versions affected
  • Drupal 7.0, 7.1 and 7.2.
Solution

Install the latest version:

  • If you are running Drupal 7.x then upgrade to Drupal 7.3 or 7.4.

The Security Team has released both a pure security update without other bug fixes and a security update combined with other bug fixes and improvements. You can choose to either only include the security update for an immediate fix (which might require less quality assurance and testing) or more fixes and improvements alongside the security fixes by choosing between Drupal 7.3 and Drupal 7.4. Read the announcement for more information.

See also the Drupal core project page.

Reported by Fixed by
  • The access bypass was fixed by Károly Négyesi, member of the Drupal security team
Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 7.x

SA-CORE-2011-001 - Drupal core - Multiple vulnerabilities

Wed, 05/25/2011 - 2:07pm
  • Advisory ID: DRUPAL-SA-CORE-2011-001
  • Project: Drupal core
  • Version: 6.x, 7.x
  • Date: 2011-May-25
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass, Cross Site Scripting
Description

CVE: CVE-2011-2687

Multiple vulnerabilities and weaknesses were discovered in Drupal.

Reflected cross site scripting vulnerability in error handler

A reflected cross site scripting vulnerability was discovered in Drupal's error handler. Drupal displays PHP errors in the messages area, and a specially crafted URL can cause malicious scripts to be injected into the message. The issue can be mitigated by disabling on-screen error display at admin/settings/error-reporting. This is the recommended setting for production sites.

This issue affects Drupal 6.x only.

Cross site scripting vulnerability in Color module

When using re-colorable themes, color inputs are not sanitized. Malicious color values can be used to insert arbitrary CSS and script code. Successful exploitation requires the "Administer themes" permission.

This issue affects Drupal 6.x and 7.x.

Access bypass in File module

When using private files in combination with a node access module, the File module allows unrestricted access to private files.

This issue affects Drupal 7.x only.

Versions affected
  • Drupal 7.x before version 7.1.
  • Drupal 6.x before version 6.21.
Solution

Install the latest version:

  • If you are running Drupal 7.x then upgrade to Drupal 7.1 or 7.2.
  • If you are running Drupal 6.x then upgrade to Drupal 6.21 or 6.22.

The Security Team has released both a pure security update without other bug fixes and a security update combined with other bug fixes and improvements. You can choose to either only include the security update for an immediate fix (which might require less quality assurance and testing) or more fixes and improvements alongside the security fixes by choosing between Drupal 7.1 and Drupal 7.2 or Drupal 6.21 and Drupal 6.22.

See the release announcement for more information.

See also the Drupal core project page.

Reported by
  • The reflected cross site scripting vulnerability was reported by Heine Deelstra (*).
  • The Color module cross site scripting vulnerability was reported by Kasper Lindgaard, Secunia Research.
  • The File access bypass was reported by Hubert Lecorche, and Peter Bex.
Fixed by

(*) Member of the Drupal security team.

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 6.xDrupal 7.x

SA-CORE-2010-002 - Drupal core - Multiple vulnerabilities

Wed, 08/11/2010 - 3:53pm
  • Advisory ID: DRUPAL-SA-CORE-2010-002
  • Project: Drupal core
  • Version: 5.x, 6.x
  • Date: 2010-August-11
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities
Description

Multiple vulnerabilities and weaknesses were discovered in Drupal.

OpenID authentication bypass

The OpenID module provides users the ability to login to sites using an OpenID account.

The OpenID module doesn't implement all the required verifications from the OpenID 2.0 protocol and is vulnerable to a number of attacks.

Specifically:
- OpenID should verify that a "openid.response_nonce" has not already been used for an assertion by the OpenID provider
- OpenID should verify the value of openid.return_to as obtained from the OpenID provider
- OpenID must verify that all fields that are required to be signed are signed

These specification violations allow malicious sites to harvest positive assertions from OpenID providers and use them on sites using the OpenID module to obtain access to preexisting accounts bound to the harvested OpenIDs. Intercepted assertions from OpenID providers can also be replayed and used to obtain access to user accounts bound to the intercepted OpenIDs.

This issue affects Drupal 6.x only. A separate security announcement and release is published for the contributed OpenID module for Drupal 5.x.

File download access bypass

The upload module allows users to upload files and provides access checking for file downloads.

The module looks up files for download in the database and serves them for download after access checking. However, it does not account for the fact that certain database configurations will not consider case differences in file names. If a malicious user uploads a file which only differs in letter case, access will be granted for the earlier upload regardless of actual file access to that.

This issue affects Drupal 5.x and 6.x.

Comment unpublishing bypass

The comment module allows users to leave comments on content on the site.

The module supports unpublishing comments by privileged users. Users with the "post comments without approval" permission however could craft a URL which allows them to republish previously unpublished comments.

This issue affects Drupal 5.x and 6.x.

Actions cross site scripting

The actions feature combined with Drupal's trigger module allows users to configure certain actions to happen when users register, content is submitted, and so on; through a web based interface.

Users with "administer actions permission" can enter action descriptions and messages which are not properly filtered on output. Users with content and taxonomy tag submission permissions can create nodes and taxonomy terms which are not properly sanitized for inclusion in action messages and inject arbitrary HTML and script code into Drupal pages. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS).

This issue affects Drupal 6.x only.

Versions affected
  • Drupal 6.x before version 6.18 or 6.19.
  • Drupal 5.x before version 5.23.
Solution

Install the latest version:

Drupal 5 will no longer be maintained when Drupal 7 is released. Upgrading to Drupal 6 is recommended.

The security team starts a new practice of releasing both a pure security update without other bugfixes and a security update combined with other bug fixes and improvements. You can choose to either only include the security update for an immediate fix (which might require less quality assurance and testing) or more fixes and improvements alongside the security fixes by choosing between Drupal 6.18 and Drupal 6.19. Read the announcement for more information.

Reported by

The OpenID authentication bypass issues were reported by Johnny Bufu, Christian Schmidt and Heine Deelstra (*).
The file download access bypass was reported by Wolfgang Ziegler.
The comment unpublish bypass issue was reported by Heine Deelstra (*).
The actions module cross site scripting was reported by Justin Klein Keane and Heine Deelstra (*).

(*) Member of the Drupal security team.

Fixed by

The OpenID authentication issues were fixed by Christian Schmidt, Heine Deelstra (*) and Damien Tournoud (*).
The file download access bypass was fixed by Dave Reid (*) and Neil Drumm (*).
The comment unpublish bypass issue was fixed by Heine Deelstra (*).
The actions module cross site scripting was fixed by Justin Klein Keane and Heine Deelstra (*).

(*) Member of the Drupal security team.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Drupal version: Drupal 5.xDrupal 6.x

SA-CORE-2010-001 - Drupal core - Multiple vulnerabilities

Wed, 03/03/2010 - 2:31pm
  • Advisory ID: DRUPAL-SA-CORE-2010-001
  • Project: Drupal core
  • Version: 5.x, 6.x
  • Date: 2010-March-03
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting, Open redirect, Authorization vulnerability
Description

Multiple vulnerabilities and weaknesses were discovered in Drupal.

Installation cross site scripting

A user-supplied value is directly output during installation allowing a malicious user to craft a URL and perform a cross-site scripting attack. The exploit can only be conducted on sites not yet installed.

This issue affects Drupal 6.x only.

Open redirection

The API function drupal_goto() is susceptible to a phishing attack. An attacker could formulate a redirect in a way that gets the Drupal site to send the user to an arbitrarily provided URL. No user submitted data will be sent to that URL.

This issue affects Drupal 5.x and 6.x.

Locale module cross site scripting

Locale module and dependent contributed modules do not sanitize the display of language codes, native and English language names properly. While these usually come from a preselected list, arbitrary administrator input is allowed. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer languages' permission.

This issue affects Drupal 5.x and 6.x.

Blocked user session regeneration

Under certain circumstances, a user with an open session that is blocked can maintain his/her session on the Drupal site, despite being blocked.

This issue affects Drupal 5.x and 6.x.

Versions affected
  • Drupal 6.x before version 6.16.
  • Drupal 5.x before version 5.22.
Solution

Install the latest version:

  • If you are running Drupal 6.x then upgrade to Drupal 6.16.
  • If you are running Drupal 5.x then upgrade to Drupal 5.22.

Drupal 5 will no longer be maintained when Drupal 7 is released. Upgrading to Drupal 6 is recommended.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. These patches fix the security vulnerabilities, but do not contain other fixes which were released in Drupal 6.16 or Drupal 5.22.

Reported by

The installation cross site scripting issue was reported by David Rothstein (*).
The open redirection was reported by Martin Barbella.
The locale module cross site scripting was reported by Justin Klein Keane.
The blocked user session regeneration issue was reported by Craig A. Hancock.

(*) Member of the Drupal security team.

Fixed by

The installation cross site scripting issue was fixed by Heine Deelstra.
The open redirection was fixed by Gerhard Killesreiter and Heine Deelstra.
The locale module cross site scripting was fixed by Stéphane Corlosquet, Peter Wolanin, Heine Deelstra and Neil Drumm.
The blocked user session regeneration issue was fixed by Gerhard Killesreiter.

All the fixes were done by members of the Drupal security team.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Front page news: Drupal NewsDrupal version: Drupal 5.xDrupal 6.x

SA-CORE-2009-009 - Drupal Core - Cross site scripting

Wed, 12/16/2009 - 4:17pm
  • Advisory ID: DRUPAL-SA-CORE-2009-009
  • Project: Drupal core
  • Version: 5.x, 6.x
  • Date: 2009-December-16
  • Security risk: Not critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting
Description

Multiple vulnerabilities were discovered in Drupal.

Contact category name cross-site scripting

The Contact module does not correctly handle certain user input when displaying category information. Users privileged to create contact categories can insert arbitrary HTML and script code into the contact module administration page. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS).

This issue affects Drupal 6.x and Drupal 5.x.

Menu description cross-site scripting

The Menu module does not correctly handle certain user input when displaying the menu administration overview. Users privileged to create new menus can insert arbitrary HTML and script code into the menu module administration page. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS).

This issue affects Drupal 6.x only.

Versions affected
  • Drupal 5.x before version 5.21.
  • Drupal 6.x before version 6.15.
Solution

Install the latest version:

  • If you are running Drupal 6.x then upgrade to Drupal 6.15.
  • If you are running Drupal 5.x then upgrade to Drupal 5.21.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. Theses patches fix the security vulnerability, but do not contain other fixes which were released in Drupal 5.21 or Drupal 6.15.

Reported by

The contact category XSS issue was independently reported by mr.baileys and Justin Klein Keane.
The menu description XSS issue was reported by mr.baileys.

Fixed by

The contact category XSS issue was fixed by Justin Klein Keane and Dave Reid.
The menu description XSS issue was fixed by Gábor Hojtsy and Heine Deelstra.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Drupal version: Drupal 5.xDrupal 6.x

SA-CORE-2009-008 - Drupal core - Multiple vulnerabilities

Wed, 09/16/2009 - 3:39pm
  • Advisory ID: DRUPAL-SA-CORE-2009-008
  • Project: Drupal core
  • Version: 5.x, 6.x
  • Date: 2009-September-16
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities
Description

Multiple vulnerabilities and weaknesses were discovered in Drupal.

OpenID association cross site request forgeries

The OpenID module in Drupal 6 allows users to create an account or log into a Drupal site using one or more OpenID identities.

The core OpenID module does not correctly implement Form API for the form that allows one to link user accounts with OpenID identifiers. A malicious user is therefore able to use cross site request forgeries to add attacker controlled OpenID identities to existing accounts. These OpenID identities can then be used to gain access to the affected accounts.

This issue affects Drupal 6.x only.

OpenID impersonation

The OpenID module is not a compliant implementation of the OpenID Authentication 2.0 specification. An implementation error allows a user to access the account of another user when they share the same OpenID 2.0 provider.

This issue affects Drupal 6.x only.

File upload

File uploads with certain extensions are not correctly processed by the File API. This may lead to the creation of files that are executable by Apache. The .htaccess that is saved into the files directory by Drupal should normally prevent execution. The files are only executable when the server is configured to ignore the directives in the .htaccess file.

This issue affects Drupal 6.x only.

Session fixation

Drupal doesn't regenerate the session ID when an anonymous user follows the one time login link used to confirm email addresses and reset forgotten passwords. This enables a malicious user to fix and reuse the session id of a victim under certain circumstances.

This issue affects Drupal 5.x only.

Versions affected
  • Drupal 6.x before version 6.14.
  • Drupal 5.x before version 5.20.
Solution

Install the latest version:

  • If you are running Drupal 6.x then upgrade to Drupal 6.14.
  • If you are running Drupal 5.x then upgrade to Drupal 5.20.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. Theses patches fix the security vulnerabilities, but do not contain other fixes which were released in Drupal 6.14 or Drupal 5.20.

Important note: Some users using OpenID might not be able to use the existing OpenID associations to login after the upgrade. These users should use the one time login via password recovery to get access to their user account and re-add desired associations. These users likely had issues with OpenID logins prior to the upgrade.

Reported by

The session fixation issue was reported by Noel Sharpe.
OpenID impersonation was reported by Robert Metcalf.
OpenID association CSRF was reported by Heine Deelstra (*).
The file upload issue was reported by Heine Deelstra (*).

(*) Member of the Drupal security team

Fixed by

The session fixation issue was fixed by Jakub Suchy.
The OpenID and file upload issues were fixed by Heine Deelstra.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Drupal version: Drupal 5.xDrupal 6.x

SA-CORE-2009-007 - Drupal core - Multiple vulnerabilities

Wed, 07/01/2009 - 4:56pm
  • Advisory ID: DRUPAL-SA-CORE-2009-007
  • Project: Drupal core
  • Version: 5.x, 6.x
  • Date: 2009-July-1
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities
Description

Multiple vulnerabilities and weaknesses were discovered in Drupal.

Cross-site scripting

The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS).

This issue affects Drupal 6.x only.

Input format access bypass

User signatures have no separate input format, they use the format of the comment with which they are displayed. A user will no longer be able to edit a comment when an administrator changes the comment's input format to a format that is not accessible to the user. However they will still be able to modify their signature, which will then be processed by the new input format.

If the new format is very permissive, via their signature, the user may be able to insert arbitrary HTML and script code into pages or, when the PHP filter is enabled for the new format, execute PHP code.

This issue affects Drupal 6.x only.

Password leaked in URL

When an anonymous user fails to login due to mistyping his username or password, and the page he is on contains a sortable table, the (incorrect) username and password are included in links on the table. If the user visits these links the password may then be leaked to external sites via the HTTP referer.

In addition, if the anonymous user is enticed to visit the site via a specially crafted URL while the Drupal page cache is enabled, a malicious user might be able to retrieve the (incorrect) username and password from the page cache.

This issue affects both Drupal 5.x and Drupal 6.x

Versions affected
  • Drupal 5.x before version 5.19.
  • Drupal 6.x before version 6.13.
Solution

Install the latest version:

  • If you are running Drupal 6.x then upgrade to Drupal 6.13.
  • If you are running Drupal 5.x then upgrade to Drupal 5.19.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. Theses patches fix the security vulnerability, but do not contain other fixes which were released in Drupal 5.19 or Drupal 6.13.

Reported by

The forum XSS issue was independently reported by Mark Piper of Catalyst IT Ltd, Sven Herrmann and Brandon Knight.
The user signature issue was reported by Gerhard Killesreiter of the Drupal security team.
The password in URL issue was reported by Sumit Datta.

Fixed by

The forum XSS issue was fixed by Heine Deelstra, Peter Wolanin and Charlie Gordon.
The user signature issue was fixed by David Rothstein, Charlie Gordon, Heine Deelstra and Gábor Hojtsy.
The password in URL issue was fixed by Damien Tournoud and Bart Jansens.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Drupal version: Drupal 5.xDrupal 6.x

SA-CORE-2009-006 - Drupal core - Cross site scripting

Wed, 05/13/2009 - 3:47pm
  • Advisory ID: DRUPAL-SA-CORE-2009-006
  • Project: Drupal core
  • Version: 5.x, 6.x
  • Date: 2009-May-13
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting
Description

When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.

Certain byte sequences that are valid in the UTF-8 specification are potentially dangerous when interpreted as UTF-7. Internet Explorer 6 and 7 may decode these characters as UTF-7 if they appear before the <meta http-equiv="Content-Type" /> tag that specifies the page content as UTF-8, despite the fact that Drupal also sends a real HTTP header specifying the content as UTF-8. This enables attackers to execute cross site scripting attacks with UTF-7. SA-CORE-2009-005 - Drupal core - Cross site scripting contained an incomplete fix for the issue. HTML exports of books are still vulnerable, which means that anyone with edit permissions for pages in outlines is able to insert arbitrary HTML and script code in these exports.

Additionally, the taxonomy module allows users with the 'administer taxonomy' permission to inject arbitrary HTML and script code in the help text of any vocabulary.

Wikipedia has more information about cross site scripting (XSS).

Versions affected
  • Drupal 5.x before version 5.18.
  • Drupal 6.x before version 6.12.
Solution

Install the latest version:

  • If you are running Drupal 6.x then upgrade to Drupal 6.12.
  • If you are running Drupal 5.x then upgrade to Drupal 5.18.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. Theses patches fix the security vulnerability, but does not contain other fixes which were released in Drupal 5.18 or Drupal 6.12.

Reported by

The UTF-7 XSS issue in book-export-html.tpl.php was reported by Markus Petrux.

The XSS issue in taxonomy module was publicly disclosed.

Fixed by

Both issues were fixed by Heine Deelstra, Peter Wolanin and Derek Wright of the Drupal Security Team.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Drupal version: Drupal 5.xDrupal 6.x

SA-CORE-2009-005 - Drupal core - Cross site scripting

Wed, 04/29/2009 - 9:48pm
  • Advisory ID: DRUPAL-SA-CORE-2009-005
  • Project: Drupal core
  • Version: 5.x, 6.x
  • Date: 2009-April-29
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting
Description

When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.

Certain byte sequences that are valid in the UTF-8 specification are potentially dangerous when interpreted as UTF-7. Internet Explorer 6 and 7 may decode these characters as UTF-7 if they appear before the <meta http-equiv="Content-Type" /> tag that specifies the page content as UTF-8, despite the fact that Drupal also sends a real HTTP header specifying the content as UTF-8. This behaviour enables malicious users to insert and execute Javascript in the context of the website if site visitors are allowed to post content.

Wikipedia has more information about cross site scripting (XSS).

In addition, Drupal core also has a very limited information disclosure vulnerability under very specific conditions. If a user is tricked into visiting the site via a specially crafted URL and then submits a form (such as the search box) from that page, the information in their form submission may be directed to a third-party site determined by the URL and thus disclosed to the third party. The third party site may then execute a CSRF attack against the submitted form.

This vulnerability is limited to forms present on the frontpage. The user login form is not vulnerable.

Versions affected
  • Drupal 5.x before version 5.17.
  • Drupal 6.x before version 6.11.
Solution

Install the latest version:

  • If you are running Drupal 6.x then upgrade to Drupal 6.11.
  • If you are running Drupal 5.x then upgrade to Drupal 5.17.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. Theses patches fix the security vulnerability, but does not contain other fixes which were released in Drupal 5.17 or Drupal 6.11.

As an alternate solution if you are unable to upgrade immediately, you can alter your page template following the pattern in the core changes. Open your theme's main page.tpl.php file as well as any other page templates like page-node.tpl.php or page-front.tpl.php and move the line that is printing $head (<?php print $head ?>) above line with the <title> tag, so that it is the first item after the <head>.

Reported by

The UTF-7 XSS issue was reported by pod.Edge.

The information disclosure vulnerability was reported by Moritz Naumann.

Fixed by

The Drupal security team

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Drupal version: Drupal 5.xDrupal 6.x

New pages and RSS feeds for security announcements

Wed, 03/18/2009 - 11:51am
Separate Security Announcements by Type

To make the impact of different security advisories and announcements easier to see, they are now separated by type.

Drupal core security advisories: http://drupal.org/security
RSS feed for Drupal core: http://drupal.org/security/rss.xml

Contributed project security advisories: http://drupal.org/security/contrib
RSS feed for contributed projects: http://drupal.org/security/contrib/rss.xml

Public service announcements: http://drupal.org/security/psa
RSS feed for announcements: http://drupal.org/security/psa/rss.xml

We encourage those using RSS readers to track security-related developments to subscribe to all three of these feeds.

All posts to each of these three forums will still be sent to the one security announcements e-mail list. To subscribe to that e-mail list, once logged in, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab.

All future public service announcements will only be posted to the Public service announcements page and feed.

Background on the Changes

At Drupalcon in Washington, D.C. earlier this month, members of the Security team held a "Birds of a Feather" session to discusses various topics including improvements to our process of communicating with the public.

One outcome of this meeting was that we decided to more clearly differentiate among security advisories for Drupal core (which affect all users) as opposed to security advisories for contributed projects (which are often used by only tens of sites). In addition, the security team has on occasion issued announcements (such as this one), which were previously mixed in with actual security advisories.

Since the Drupal 6.x upgrade of http://drupal.org, newsletter postings have been managed using forums. The security team has thus split security-related postings among three forums under http://drupal.org/forum/1188.

All past and new advisories and announcements and their feeds can be viewed (via tabs) on http://drupal.org/security.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Front page news: Planet Drupal

SA-CORE-2009-004 - Local file inclusion on Windows

Wed, 02/25/2009 - 5:58pm
  • Advisory ID: DRUPAL-SA-CORE-2009-004
  • Project: Drupal core
  • Versions: 5.x
  • Date: 2009-February-25
  • Security risk: Highly Critical
  • Exploitable from: Remote
  • Vulnerability: Local file inclusion on Windows
  • Reference: SA-CORE-2009-003 (6.x)
Description

This vulnerability exists on Windows, regardless of the type of webserver (Apache, IIS) used.

The Drupal theme system takes URL arguments into account when selecting a template file to use for page rendering. While doing so, it doesn't take into account how Windows arrives at a canonicalized path. This enables malicious users to include files, readable by the webserver and located on the same volume as Drupal, and to execute PHP contained within those files. For example: If a site has uploads enabled, an attacker may upload a file containing PHP code and cause it to be included on a subsequent request by manipulating the URL used to access the site.

Important note: An attacker may also be able to inject PHP code into webserver logs and subsequently include the log file, leading to code execution even if no upload functionality is enabled on the site.

Versions Affected
  • Drupal 5.x before version 5.16
Solution

Install the latest version:

  • If you are running Drupal 5.x then upgrade to Drupal 5.16.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. The patch fixes the security vulnerability, but does not contain other fixes which were released in Drupal 5.16.

Reported by

Bogdan Calin (www.acunetix.com)

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Drupal version: Drupal 5.x

SA-CORE-2009-003 - Local file inclusion on Windows

Wed, 02/25/2009 - 1:16pm
  • Advisory ID: DRUPAL-SA-CORE-2009-003
  • Project: Drupal core
  • Versions: 6.x
  • Date: 2009-February-25
  • Security risk: Highly Critical
  • Exploitable from: Remote
  • Vulnerability: Local file inclusion on Windows
Description

This vulnerability exists on Windows, regardless of the type of webserver (Apache, IIS) used.

The Drupal theme system takes URL arguments into account when selecting a template file to use for page rendering. While doing so, it doesn't take into account how Windows arrives at a canonicalized path. This enables malicious users to include files, readable by the webserver and located on the same volume as Drupal, and to execute PHP contained within those files. For example: If a site has uploads enabled, an attacker may upload a file containing PHP code and cause it to be included on a subsequent request by manipulating the URL used to access the site.

Important note: An attacker may also be able to inject PHP code into webserver logs and subsequently include the log file, leading to code execution even if no upload functionality is enabled on the site.

Versions Affected
  • Drupal 6.x before version 6.10
Solution

Install the latest version:

  • If you are running Drupal 6.x then upgrade to Drupal 6.10.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. The patch fixes the security vulnerability, but does not contain other fixes which were released in Drupal 6.10.

Reported by

Bogdan Calin (www.acunetix.com)

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Drupal version: Drupal 6.x

SA-CORE-2009-001 Drupal core - Multiple vulnerabilities

Wed, 01/14/2009 - 7:00pm
  • Advisory ID: DRUPAL-SA-CORE-2009-001
  • Project: Drupal core
  • Versions: 5.x and 6.x
  • Date: 2009-January-14
  • Security risk: Moderately Critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

Multiple vulnerabilities and weaknesses were discovered in Drupal.

Access Bypass

The Content Translation module for Drupal 6.x enables users to make a translation of an existing item of content (a node). In that process the existing node's content is copied into the new node's submission form.

The module contains a flaw that allows a user with the 'translate content' permission to potentially bypass normal viewing access restrictions, for example allowing the user to see the content of unpublished nodes even if they do not have permission to view unpublished nodes.

This issue only affects Drupal 6.x.

Validation Bypass

When user profile pictures are enabled, the default user profile validation function will be bypassed, possibly allowing invalid user names or e-mail addresses to be submitted.

This issue only affects Drupal 6.x.

Hardening against SQL injection

A parameter passed into the node access API was not properly escaped or validated before being used in SQL queries. While there is no direct risk of SQL injection from Drupal core, it's possible that this could have presented a risk in combination with a contributed module. Additional validation has been added to eliminate this risk.

This issue affects both Drupal 5.x and Drupal 6.x.

Versions Affected
  • Drupal 5.x before version 5.15.
  • Drupal 6.x before version 6.9.
Solution

Install the latest version:

  • If you are running Drupal 5.x then upgrade to Drupal 5.15.
  • If you are running Drupal 6.x then upgrade to Drupal 6.9.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. The patches fix security vulnerabilities, but do not contain other fixes which were released in these versions.

Reported by

The access bypass issue for translations was reported by Wolfgang Ziegler.

The validation bypass was reported by v1nce, supersmashbrothers, Tejus Pratap, and Limiting Factor.

The need for SQL hardening was reported by Derek Wright of the Drupal Security Team.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Drupal version: Drupal 5.xDrupal 6.x

Pages