Open Redirect Vulnerability in Drupal Core
Summary
CVE-2016-3167: Drupal Open redirect vulnerability in the drupal_goto function. Affects drupal/core versions >= 6.0, < 6.38. Fixed in 6.38. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and web applications. The Drupal Core package is the foundation of the Drupal CMS, providing essential functionality and features. However, a vulnerability has been discovered in versions prior to 6.38 that allows for open redirect attacks.
Vulnerability Detail
The vulnerability, identified as GHSA-gxwx-c7m8-f95h, exists in the drupal_goto function of Drupal Core. When used with PHP versions before 5.4.7, it allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks. This can be achieved by exploiting a double-encoded URL in the "destination" parameter. The impact of this vulnerability is significant as it can lead to unauthorized access, data theft, and other malicious activities.
How To Fix
Minimum fixed version
6.38
This is the first release that contains the fix.
composer require drupal/core:6.38Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading immediately is not feasible, a temporary workaround can be implemented by modifying the affected code. The drupal_goto function can be modified to validate and sanitize the "destination" parameter before processing the redirect. Here is an example of the modified code:
function drupal_goto($path = '', $query = NULL, $fragment = NULL, $http_response_code = 302) {
// Validate and sanitize the "destination" parameter.
$destination = isset($_GET['destination']) ? $_GET['destination'] : NULL;
$destination = filter_var($destination, FILTER_SANITIZE_URL);
// Perform the redirect with the sanitized destination.
header('Location: ' . $destination, TRUE, $http_response_code);
exit;
}
Note that this is a temporary solution and upgrading to the latest version is still recommended.
Conclusion
The open redirect vulnerability in Drupal Core can have serious consequences, including unauthorized access and data theft. It is crucial to promptly upgrade to version 6.38 or later to mitigate this vulnerability. If immediate upgrading is not possible, implementing the provided workaround can help mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
An open redirect vulnerability occurs when a web application allows external input to control the destination of a redirect. Attackers can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks and other malicious activities.
Versions of Drupal Core prior to 6.38 are affected by this open redirect vulnerability.
The impact of this vulnerability can be significant. Attackers can redirect users to malicious websites, leading to unauthorized access, data theft, and other malicious activities.
To fix this vulnerability, it is recommended to upgrade to Drupal Core version 6.38 or later. This version includes a patch that addresses the open redirect issue.
Yes, a temporary workaround is available by modifying the affected code. The drupal_goto function can be modified to validate and sanitize the "destination" parameter before processing the redirect.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
