Security Advisories

The Mime Mail module gives Backdrop sites the ability to send HTML email messages.

Under rare site configuration conditions, a person with the ability to send HTML emails could send non-public data that had been uploaded to the files directory. 

This vulnerability is mitigated by the fact the attacker would need advance knowledge of uploaded files, and also have permission to send HTML emails and set the recipient list.

S3 File System (s3fs) provides an additional file system to your Backdrop site that stores files in Amazon's Simple Storage Service (S3) storage.

The module doesn't sufficiently isolate upload context between separate object (file) operations in the same request, resulting in the potential for objects to be uploaded with incorrect access control list (ACL) entries or corruption through incorrect operation metadata.

This can be triggered by normal file operations, such as uploads, image style derivatives and bee s3fs-copy-local.

Some vectors are mitigated by:

• Not enabling "Use S3 for private:// files", or (1.x-4.x only) only enabling it with "Don't set ACLs on uploaded objects".
• The site does not implement hook_s3fs_upload_params_alter().

If both points above have always been true all currently known vectors are mitigated.

A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type.

Backdrop CMS doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.

The Image module defines image fields and generates resized derivatives of uploaded images on demand.

The module never asks the file download access hook whether the requester may see the source image before generating and returning the derivative. A site that serves private images through a contributed stream wrapper therefore discloses those derivatives even if the backing store itself is not reachable over the web. The unauthorized request also writes a fresh derivative into that store.

This vulnerability is mitigated by the fact that Backdrop CMS must be configured to serve private derived images through a contributed file scheme rather than the core private scheme.

Backdrop CMS does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed.

This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within img tags, which prevents script from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments.

In affected configurations, Webform did not sufficiently validate a managed file upload element when processing a new submission. A user with access to submit a vulnerable webform could potentially access other managed files they were not authorized to view.

This vulnerability is mitigated by the fact that a site must have a Webform with a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own webform submissions or sending uploads as email attachments.

The Webform module allows people to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files.

The module does not sufficiently force certain uploaded file types to download when served. Under certain site configurations, a file uploaded through a webform could be rendered inline by a browser, resulting in a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that someone with permission to create or edit webforms must configure the form to allow the affected file extensions, and someone must specifically open the uploaded file.

Backdrop CMS doesn't sufficiently protect configuration exports when delivering a compressed archive.

This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission.

The Backdrop project uses the CKEditor library for rich-text editing. CKEditor has released a security update that impacts Backdrop CMS.

Vulnerabilities are possible if Backdrop is configured to use CKEditor for rich-text editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit this Cross-Site Scripting (XSS) vulnerability to target other people with access to the rich-text CKEditor, including site admins with privileged access.

For more information, see CKEditor's security advisory:

• High-severity Cross-site scripting (XSS) in the engine package

Instructions for contributed modules

Some contributed projects may use additional CKEditor plugins that are not packaged in Backdrop core. People should review their own sites if they use one of these projects. CKEditor has also released another CVE that does not affect Backdrop, but may affect custom plugins or other use cases:

• Low-severity Cross-site scripting (XSS) in the engine package