Drupal Form API ignores access restrictions on submit buttons
Summary
CVE-2016-3165: Drupal Form API ignores access restrictions on submit buttons. Affects drupal/core versions >= 6.0, < 6.38. Fixed in 6.38. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible framework for building websites and applications. The Form API is a key component of Drupal that allows developers to create and handle forms. It provides a set of functions and methods for defining, rendering, and processing forms. However, a vulnerability has been discovered in the Form API of Drupal versions 6.x before 6.38. This vulnerability allows remote attackers to bypass access restrictions on submit buttons, potentially leading to unauthorized actions or data manipulation.
Vulnerability Detail
The vulnerability arises from the Form API's failure to enforce access restrictions on submit buttons. In Drupal 6.x before 6.38, the '#access' property of a submit button in the server-side form definition is not properly checked. This means that even if a user does not have the necessary permissions to access or submit a form, they can still do so by leveraging a button with '#access' set to FALSE. This bypasses the intended access restrictions and allows the attacker to perform actions that should be restricted. The impact of this vulnerability depends on the specific form and the permissions associated with it. However, it could potentially lead to unauthorized data modification, privilege escalation, or other malicious activities.
How To Fix
Minimum fixed version
6.38
This is the first release that contains the fix.
composer require drupal/core:6.38Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to Drupal 6.38 or later is not immediately feasible, a temporary workaround can be implemented by manually modifying the affected forms. Developers can review the form definitions and ensure that the '#access' property of submit buttons is properly set according to the desired access restrictions. By explicitly setting '#access' to TRUE or FALSE based on the required permissions, the vulnerability can be mitigated. However, this workaround is not recommended as it requires manual intervention and may introduce human error. Upgrading to the latest version of Drupal is the recommended solution.
Conclusion
In conclusion, the Drupal Form API vulnerability allows remote attackers to bypass access restrictions on submit buttons, potentially leading to unauthorized actions or data manipulation. To mitigate this vulnerability, it is recommended to upgrade to Drupal version 6.38 or later. Regularly updating and maintaining your Drupal installation is crucial for overall security. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
The vulnerability affects Drupal versions 6.x before 6.38.
The impact of this vulnerability depends on the specific form and the permissions associated with it. However, it could potentially lead to unauthorized data modification, privilege escalation, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to Drupal version 6.38 or later.
Yes, a temporary workaround can be implemented by manually modifying the affected forms.
Upgrading to the latest version of Drupal is generally a good practice to benefit from the latest security patches and improvements.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
