Security Advisories

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments.

In affected configurations, Webform did not sufficiently validate a managed file upload element when processing a new submission. A user with access to submit a vulnerable webform could potentially access other managed files they were not authorized to view.

This vulnerability is mitigated by the fact that a site must have a Webform with a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own webform submissions or sending uploads as email attachments.

The Webform module allows people to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files.

The module does not sufficiently force certain uploaded file types to download when served. Under certain site configurations, a file uploaded through a webform could be rendered inline by a browser, resulting in a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that someone with permission to create or edit webforms must configure the form to allow the affected file extensions, and someone must specifically open the uploaded file.

Backdrop CMS doesn't sufficiently protect configuration exports when delivering a compressed archive.

This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission.

A CVE has been requested, and this page will be updated as soon as an official number has been issued.

The Backdrop project uses the CKEditor library for rich-text editing. CKEditor has released a security update that impacts Backdrop CMS.

Vulnerabilities are possible if Backdrop is configured to use CKEditor for rich-text editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit this Cross-Site Scripting (XSS) vulnerability to target other people with access to the rich-text CKEditor, including site admins with privileged access.

For more information, see CKEditor's security advisory:

• High-severity Cross-site scripting (XSS) in the engine package

Instructions for contributed modules

Some contributed projects may use additional CKEditor plugins that are not packaged in Backdrop core. People should review their own sites if they use one of these projects. CKEditor has also released another CVE that does not affect Backdrop, but may affect custom plugins or other use cases:

• Low-severity Cross-site scripting (XSS) in the engine package

This module suite implements a mapping functionality between Salesforce objects and Backdrop entities

This module does not generate or validate a cryptographically random `state` parameter to protect the authorization flow against CSRF attacks. 

Additionally, the OAuth callback is accessible to most authenticated and potentially anonymous users depending on site configuration.

Backdrop allows administrators to upload certain files that could be executable. The vulnerability is mitigated by the fact that it requires administrator level access, and in most server configurations, execution of uploaded files is disabled by the server or the .htaccess files created by Backdrop. In the most recent release, a hardening of file types that may not be uploaded and directories that may not be uploaded to will help prevent administrators from accidentally writing into system directories. The list of unsafe extensions is expanded significantly to further reduce the chances of uploaded files from being executed.

Because this configuration already requires administrator-level permissions, the improvements in the latest release is considered a security hardening and not exploitable by unprivileged user accounts.

Backdrop bulk operations did not always check permissions appropriately. This could allow someone with permission to use bulk operations generally to use bulk operations on the file management page and delete files that they did not have specific permission to delete. This vulnerability is mitigated by the fact that the user must have the Access the manage files overview permission.

Backdrop's project installer does not check against a generated token before queuing projects to be downloaded from the Backdrop contrib repository. A user that has permission to post content could craft special tag to queue projects and download the projects. This vulnerability is mitigated by the fact that the user needs the ability to post HTML, and needs to get a privileged user to view the content they post. Additionally, there is no known way to enable projects, only download them.

Backdrop core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to a cross-site scripting (XSS) vulnerability.

The Protected Pages module module allows you to protect individual pages with a password.

The module doesn't limit the number of password attempts, making it vulnerable to brute force attacks.

This vulnerability is mitigated by the fact that an attacker must know the protected page's URL.