• Advisory ID: DRUPAL-SA-CORE-2015-001
• Project: Drupal core
• Version: 6.x, 7.x
• Date: 2015-March-18
• Security risk: 14/25 ( Moderately Critical) AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default
• Vulnerability: Access bypass, Open Redirect, Multiple vulnerabilities

Description

Access bypass (Password reset URLs – Drupal 6 and 7)

Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user’s account without knowing the account’s password.

In Drupal 7, this vulnerability is mitigated by the fact that it can only be exploited on sites where accounts have been imported or programmatically edited in a way that results in the password hash in the database being the same for multiple user accounts. In Drupal 6, it can additionally be exploited on sites where administrators have created multiple new user accounts with the same password via the administrative interface, or where accounts have been imported or programmatically edited in a way that results in the password hash in the database being empty for at least one user account.

Drupal 6 sites that have empty password hashes, or a password field with a guessable string in the database, are especially prone to this vulnerability. This could apply to sites that use external authentication so that the password field is set to a fixed, invalid value.

Open redirect (Several vectors including the “destination” URL parameter – Drupal 6 and 7)

Drupal core and contributed modules frequently use a “destination” query string parameter in URLs to redirect users to a new destination after completing an action on the current page. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.

In addition, several URL-related API functions in Drupal 6 and 7 can be tricked into passing through external URLs when not intending to, potentially leading to additional open redirect vulnerabilities.

This vulnerability is mitigated by the fact that many common uses of the “destination” parameter are not susceptible to the attack. However, all confirmation forms built using Drupal 7’s form API are vulnerable via the Cancel action that appears at the bottom of the form, and some Drupal 6 confirmation forms are vulnerable too.

CVE identifier(s) issued

• A CVE identifier will be requested, and added upon issuance, in accordance
  with Drupal Security Team processes.

Versions affected

• Drupal core 6.x versions prior to 6.35
• Drupal core 7.x versions prior to 7.35

Solution

Install the latest version:

• If you use the Drupal 6.x, upgrade to Drupal core 6.35
• If you use the Drupal 7.x, upgrade to Drupal core 7.35

Also see the Drupal core project page.

Reported by

Access bypass via password reset URLs:

• Daniël Smidt

Open redirect via vectors including the “destination” URL parameter:

• Hunter Fox of the Drupal Security Team
• Vlad Stratulat
• Michael Smith
• Dave Reid of the Drupal Security Team

Fixed by

Access bypass via password reset URLs:

• Klaus Purer of the Drupal Security Team
• David Rothstein of the Drupal Security Team
• Peter Wolanin of the Drupal Security Team
• Ben Dougherty, provisional member of the Drupal Security Team

Open redirect via vectors including the “destination” URL parameter:

• Klaus Purer of the Drupal Security Team
• David Rothstein of the Drupal Security Team
• Hunter Fox of the Drupal Security Team
• Tom Phethean, provisional member of the Drupal Security Team
• David Stoline of the Drupal Security Team
• Damien McKenna, provisional member of the Drupal Security Team
• Pere Orga of the Drupal Security Team
• Ben Dougherty, provisional member of the Drupal Security Team

Coordinated by

• The Drupal Security Team

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity