Date:
Wednesday, Mar 8th, 2017
Advisory ID:
BACKDROP-SA-CONTRIB-2017-003
Security risk:
Critical
Vulnerability:
Arbitrary PHP code execution
Versions affected:
Description:
This module provides a standardized solution for building API's so that external clients can communicate with Backdrop.
The module accepts user submitted data in PHP's serialization format ("Content-Type: application/vnd.php.serialized") which can lead to arbitrary remote code execution.
This vulnerability is mitigated by the fact that an attacker must know your Service Endpoint's path, and your Service Endpoint must have "application/vnd.php.serialized" enabled as a request parser.
Solution:
Install the latest version:
- If you use the Services 1.x-3.x module for Backdrop 1.x, upgrade to Services 1.x-3.0.1-beta
Also see the Services project page.
Reported By:
- Geoff St. Pierre for Backdrop
- Charles Fol for Drupal
Fixed By:
- docwilmot, the Backdrop module maintainer
- Geoff St. Pierre of the Backdrop CMS Security Team
- Kyle Browning, the Drupal module maintainer
- Tyler Frankenstein, the Drupal module maintainer
Coordinated By:
- docwilmot, the module maintainer
- Geoff St. Pierre of the Backdrop CMS Security Team
- Klaus Purer of the Drupal Security Team
- Michael Hess of the Drupal Security Team