Date:
Thursday, Apr 4th, 2019
Advisory ID:
BACKDROP-SA-CONTRIB-2019-006
Security risk:
Less Critical
Vulnerability:
Access bypass
Versions affected:
- Services 1.x versions prior to 1.x-3.0.4-beta
Description:
This module provides a standardized solution for building API's so that external clients can communicate with Backdrop.
The Services module has an access bypass vulnerability in its "attach_file" resource that allows users who have access to create or update pieces of content that include file fields to arbitrarily reference files they do not have access to, which can expose private files.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit a piece of content.
Solution:
Upgrade your site to the most recent version of Services. Download available on the Services 1.x-3.0.4-beta release page. See the update instructions, if needed.
Reported By:
- Samuel Mortenson of the Drupal Security Team
Fixed By:
- Tyler Frankenstein
- Gregory Netsas of the Backdrop Security Team
Coordinated By:
- Samuel Mortenson of the Drupal Security Team
- Greg Knaddison of the Drupal Security Team
- Gregory Netsas of the Backdrop Security Team