SA-CONTRIB-2015-052 – RESTful Web Services – Access Bypass

Description

This module enables you to expose Drupal entities as RESTful web services. It provides a machine-readable interface to exchange resources in JSON, XML and RDF.

The RESTWS Basic Auth submodule doesn’t sufficiently disable page caching for authenticated requests thereby leaking potentially confidential data to unauthorized users.

This vulnerability is mitigated by the fact that the RESTWS Basic Auth submodule must be enabled, page caching must be enabled and permissions for a resource containing sensitive data must be enabled (for example the User resource).

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • RESTWS 7.x-1.x versions prior to 7.x-1.5.
  • RESTWS 7.x-2.x versions prior to 7.x-2.3.

Drupal core is not affected. If you do not use the contributed RESTful Web Services module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the RESTful Web Services project page.

Reported by

Fixed by

  • Klaus Purer the module maintainer and member of the Drupal Security Team

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

SA-CONTRIB-2015-051 – Term Queue – Cross Site Scripting (XSS)

Description

Term Queue module allows you to create lists of taxonomy terms and display them in a block.

The module doesn’t sufficiently sanitize user supplied text in some administration pages, thereby exposing a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer taxonomy”.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • Term Queue 6.x-1.0

Drupal core is not affected. If you do not use the contributed Term Queue module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Term Queue project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

SA-CONTRIB-2015-050 – Services Basic Authentication – Access bypass – Unsupported

Description

Services Basic Authentication module adds HTTP basic authentication for Services module.

A user could get unauthorized access to resources under some circumstances.

This vulnerability is mitigated by the fact that the authentication works correctly when page caching is disabled.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • All versions of Services Basic Authentication module.

Drupal core is not affected. If you do not use the contributed Services Basic Authentication module, there is nothing you need to do.

Solution

If you use the Services Basic Authentication module you should uninstall it

Also see the Services Basic Authentication project page.

Reported by

Fixed by

Not applicable.

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

PHP Code Execution in jui_filter_rules Parsing Library

Posted by Timo Schmid on Feb 18

PHP Code Execution in jui_filter_rules Parsing Library
======================================================
Researcher: Timo Schmid <tschmid () ernw de>

Description
===========
jui_filter_rules[1] is a jQuery plugin which allows users to generate a
ruleset
which could be used to filter datasets inside a web application.

The plugin also provides a PHP library to turn the user submitted
ruleset into
SQL where statements for server side…

Reflecting XSS- and SQL injection-vulnerabilities in the administrative backend of Piwigo <= v. 2.7.3

Posted by Steffen Rösemann on Feb 18

Advisory: Reflecting XSS- and SQL Injection vulnerability in CMS Piwigo <=
v. 2.7.3
Advisory ID: SROEADV-2015-06
Author: Steffen Rösemann
Affected Software: CMS Piwigo <= v. 2.7.3 (Release date: 9th January 2015)
Vendor URL: http://piwigo.org
Vendor Status: patched
CVE-ID: –

==========================
Vulnerability Description:
==========================

Piwigo <= v. 2.7.3 suffers from a reflecting XSS and a SQL injection in its…

Reflected File Download in AOL Search Website

Posted by Ricardo Iramar dos Santos on Feb 18

Oren Hafif reported a new kind of attack called Reflected File Download (
https://www.blackhat.com/eu-14/briefings.html#reflected-file-download-a-new-web-attack-vector)
in Black Hat Europe 2014 conference.
More details about the attack you can found in his public presentation:
https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf
.
Google and Bing have already fixed the vulnerability but…

[CVE-REQUEST] Multiple vulnerabilities on GLPI

Posted by Stiehl on Feb 18

Multiple vulnerabilities have been identified in GLPI
(http://www.glpi-project.org).

1/ Arbitrary file upload
Severity: Important

Versions Affected
===========
All versions between 0.85 and 0.85.2

Description
=======
When an user wants to create a new ticket, he has the possibility to add
an attachment. If for example he wants to add a file named “test.php”
with or without adding the ticket, the file will be temporary uploaded
to…

SA-CONTRIB-2015-049 – Navigate – Cross Site Scripting (XSS)

Description

Navigate is a customizable navigation bar for Drupal.

The module doesn’t sufficiently sanitize user input when displaying the Navigate bar.

Because the vulnerability is a Reflected Cross Site Scripting, the only mitigating factor is that the victim must be tricked into visiting a specially crafted malicious url.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Navigate 6.x-1.x versions prior to 6.x-1.1.
  • Navigate 7.x-1.x versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Navigate module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Navigate project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

SA-CONTRIB-2015-048 – Avatar Uploader – Arbitrary PHP code execution

Description

Avatar Uploader module provides an alternative way to upload user pictures.

The module doesn’t sufficiently enforce file extensions when an avatar is uploaded, allowing users to bypass Drupal’s normal file upload protections to install malicious HTML or executable code to the server.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “upload avatar file”, and that the fix for SA-2006-006 – Drupal Core – Execution of arbitrary files in certain Apache configurations should prevent code execution in typical Apache configurations.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Avatar Uploader 6.x-1.x versions prior to 6.x-1.3.

Drupal core is not affected. If you do not use the contributed Avatar Uploader module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Avatar Uploader project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: