Date: 
Wednesday, Jun 21st, 2017
Advisory ID: 
BACKDROP-SA-CORE-2017-005
Security risk: 
Moderately Critical
Vulnerability: 
Access bypass
Versions affected: 
  • Backdrop Core 1.x.x versions prior to 1.7.1
Description: 

Files uploaded by anonymous users into a private file system can be accessed by other anonymous users - access bypass - Moderately Critical

Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Backdrop core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.

The Drupal security team has also received reports that this vulnerability is being exploited for spam purposes, similar to the scenario discussed in PSA-2016-003 for the public file system.

Solution: 

Upgrade your site to the latest version of Backdrop CMS. Download available at Backdrop CMS 1.7.1 release page. Update instructions are available at https://backdropcms.org/upgrade#from-previous-versions.

Reported By: 
Fixed By: 

Security email list

Backdrop maintains a security mailing list. Whenever a security release comes out, an email will be sent to everyone subscribed to that list, announcing the new release. Please follow the steps below to join the Security email list.

  1. Log in to backdropcms.org
  2. Edit your profile
  3. Switch to the "Subscriptions" tab
  4. Check the box labeled "Security updates"
  5. Save the form