Backdrop core - Moderately Critical - Cross Site Scripting -SA-CORE-2018-001b

Date: 
Feb 21st, 2018
Security risk: 
Moderately Critical
Vulnerability: 
Cross Site Scripting

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. This vulnerability affects sites using the version of jQuery bundled with Backdrop core (1.12.4), newer versions of jQuery are not affected.

Advisory ID: 
BACKDROP-SA-CORE-2018-001b
Versions affected: 
  • Backdrop Core versions prior to 1.9.2

Backdrop core - Critical - Moderately Critical -SA-CORE-2018-001a

Date: 
Feb 21st, 2018
Security risk: 
Moderately Critical
Vulnerability: 
Access bypass

When using Backdrop's private file system, Backdrop will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability.

This vulnerability is mitigated by the fact that it only occurs for unusual site configurations.

Advisory ID: 
BACKDROP-SA-CORE-2018-001a
Versions affected: 
  • Backdrop Core versions prior to 1.9.2

Backdrop core - Critical - Cross Site Scripting - SA-CORE-2018-001

Date: 
Feb 21st, 2018
Security risk: 
Critical
Vulnerability: 
Cross Site Scripting

JavaScript cross-site scripting prevention is incomplete - Critical

Backdrop has a Backdrop.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML. This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances.

The PHP functions which Backdrop provides for HTML escaping are not affected.

Advisory ID: 
BACKDROP-SA-CORE-2018-001
Versions affected: 
  • Backdrop Core versions prior to 1.9.2

FileField Sources - Moderately Critical - Information Disclosure - SA-CONTRIB-2018-001

Date: 
Feb 7th, 2018
Security risk: 
Moderately Critical
Vulnerability: 
Information Disclosure

This module enables you to upload files to fields via several sources.

The module doesn't sufficiently handle access control under the scenario of the autocomplete path of reference sources.

Advisory ID: 
BACKDROP-SA-CONTRIB-2018-001
Versions affected: 
  • FileField Sources module versions prior to 1.11.0

Captcha - Moderately Critical - Denial of Service - SA-CONTRIB-2017-010

Date: 
Sep 8th, 2017
Security risk: 
Moderately Critical
Vulnerability: 
Denial of Service

The Captcha module enables you to use various techniques to block automated scripts / robots from submitting content to a site, e.g. to block spam comments.

The module doesn't properly store the session ID of visitors who are given a session which could lead to a Denial of Service attack.

This vulnerability is mitigated by the fact that Backdrop does not give a session to all visitors, especially when used with advanced caching systems like Varnish.

Advisory ID: 
BACKDROP-SA-CONTRIB-2017-010
Versions affected: 
  • CAPTCHA 1.x-1.x versions prior to 1.x-1.3.5.

Backdrop core is not affected. If you do not use the contributed CAPTCHA module, there is nothing you need to do.

Backdrop core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2017-009

Date: 
Aug 16th, 2017
Security risk: 
Moderately Critical
Vulnerabilities: 
  • Cross Site Scripting
  • Access bypass

Access Bypass - Moderately Critical

When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view, however, many widely used contrib modules don't have access restrictions set on the default views they provide. Any view that does not have access controls on the default (master) display may be vulnerable. The vulnerability does not require any authentication to be exploited. A successful exploit results in some non-public data being made public.

Sites running versions of Backdrop prior to 1.x-1.7.2 should update immediately.

It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.

Cross Site Scripting - Moderately Critical
 
When creating a content type, administrators can define a Human-readable name for the type of content. The system did not filter this administrator-provided text before displaying it to the user on the Manage Displays page, creating a Cross Site Scripting (XSS) vulnerability. 
 
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer content types".
Advisory ID: 
BACKDROP-SA-CORE-2017-009
Versions affected: 
  • Backdrop Core 1.x.x versions prior to 1.7.2

Search404 - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2017-008

Date: 
Jul 26th, 2017
Security risk: 
Moderately Critical
Vulnerability: 
Cross Site Scripting

The Search 404 module enables you to redirect 404 pages to a search page on the site for the keywords in the url that was not found.

The module did not filter administrator-provided text before displaying it to the user on the 404 page creating a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer search".

Advisory ID: 
BACKDROP-SA-CONTRIB-2017-008
Versions affected: 
  • Search404 Versions prior to 1.x-1.1.2

Services - Critical - SQL Injection - SA-CONTRIB-2017-007

Date: 
Jun 29th, 2017
Security risk: 
Critical
Vulnerability: 
SQL Injection

The module doesn't sufficiently sanitize column names provided by the client when they are querying for data and trying to sort it.  

This vulnerability is mitigated by the fact that a site must have an "Index" resource enabled and the attacker must know the endpoint's URL.

Advisory ID: 
BACKDROP-SA-CONTRIB-2017-007
Versions affected: 

SMTP - Moderately Critical - Information Disclosure - SA-CONTRIB-2017-006

Date: 
Jun 28th, 2017
Security risk: 
Moderately Critical
Vulnerability: 
Information Disclosure

This SMTP module enables you to send mail using a third party (non-system) mail service instead of the local system mailer included with Backdrop. When this module is in debugging mode, it will log privileged information.

Advisory ID: 
BACKDROP-SA-CONTRIB-2017-006
Versions affected: 

Backdrop core is not affected. If you do not use the contributed SMTP Authentication Support module, there is nothing you need to do.

Backdrop core - Moderately Critical - Access Bypass - SA-CORE-2017-005

Date: 
Jun 21st, 2017
Security risk: 
Moderately Critical
Vulnerability: 
Access bypass

Files uploaded by anonymous users into a private file system can be accessed by other anonymous users - access bypass - Moderately Critical

Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Backdrop core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.

The Drupal security team has also received reports that this vulnerability is being exploited for spam purposes, similar to the scenario discussed in PSA-2016-003 for the public file system.

Advisory ID: 
BACKDROP-SA-CORE-2017-005
Versions affected: 
  • Backdrop Core 1.x.x versions prior to 1.7.1

Pages