Drupal File upload access bypass and denial of service
Summary
CVE-2016-3162: Drupal File upload access bypass and denial of service. Affects drupal/core across 2 version ranges.
>= 7.0, < 7.43
>= 8.0, < 8.0.4
Fixed in 7.43 or 8.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) used for building websites and applications. It provides a flexible and extensible platform for creating and managing digital content. The File module in Drupal allows users to upload files to the system, which can be accessed and managed through various permissions and restrictions. However, a vulnerability in Drupal versions 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and perform unauthorized actions on uploaded files.
Vulnerability Detail
The vulnerability arises from a flaw in the File module's handling of unprocessed form submissions. Remote authenticated users with permission to create content or comment and upload files can exploit this vulnerability to read, delete, or substitute a link to a file uploaded to an unprocessed form. By leveraging their permissions, attackers can bypass access restrictions and gain unauthorized access to sensitive files. This can lead to unauthorized disclosure of information, deletion of important files, or the substitution of legitimate files with malicious ones.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0, < 7.437.43composer require drupal/core:7.43 -
>= 8.0, < 8.0.48.0.4composer require drupal/core:8.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, site administrators can consider disabling the ability for users to upload files until the Drupal installation is updated. This can be achieved by adjusting user permissions or temporarily disabling the File module. However, this workaround may impact the functionality of the website or application, so it should only be used as a temporary measure until the proper update can be applied.
Conclusion
The Drupal File upload access bypass and denial of service vulnerability allows remote authenticated users to bypass access restrictions and perform unauthorized actions on uploaded files. To mitigate this vulnerability, it is crucial to update Drupal to version 7.43 or 8.0.4 and review user permissions. Disabling file uploads temporarily can serve as a workaround until the update is applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal versions 7.x before 7.43 and 8.x before 8.0.4 are affected by this vulnerability.
By exploiting this vulnerability, an attacker can bypass access restrictions and gain unauthorized access to uploaded files. They can read, delete, or substitute links to these files, potentially leading to unauthorized disclosure of information or the introduction of malicious files.
To protect your Drupal installation, it is crucial to keep the software up to date with the latest security patches. Ensure that you are running version 7.43 or 8.0.4, depending on your installed version. Additionally, review and adjust user permissions to limit access to sensitive files and prevent unauthorized actions.
Yes, a temporary workaround is to disable the ability for users to upload files until the Drupal installation is updated. This can be done by adjusting user permissions or temporarily disabling the File module. However, this workaround may impact the functionality of the website or application and should only be used as a temporary measure.
You can find more information about this vulnerability, including technical details and the recommended fix, in the official Drupal security advisory: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.