Drupal User Module Privilege Escalation
Summary
CVE-2016-3169: Drupal saving user accounts can sometimes grant the user all roles. Affects drupal/core across 2 version ranges.
>= 6.0, < 6.38
>= 7.0, < 7.43
Fixed in 6.38 or 7.43, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) used to build websites and applications. The User module in Drupal allows administrators to manage user accounts and assign roles to them. This vulnerability affects Drupal versions 6.x before 6.38 and 7.x before 7.43. The vulnerability arises when contributed or custom code calls the user_save function with an explicit category and loads all roles into the array. This can lead to privilege escalation, allowing remote attackers to gain unauthorized privileges.
Vulnerability Detail
The vulnerability in the User module of Drupal allows attackers to gain privileges by exploiting the user_save function. By leveraging contributed or custom code, an attacker can manipulate the function to load all roles into the array, granting themselves unauthorized privileges. This can have severe consequences, as attackers can gain administrative access, modify content, or perform other malicious actions on the affected Drupal site.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0, < 6.386.38composer require drupal/core:6.38 -
>= 7.0, < 7.437.43composer require drupal/core:7.43
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Drupal to the patched versions as soon as possible.
Conclusion
The Drupal User module privilege escalation vulnerability can have severe consequences, allowing attackers to gain unauthorized privileges on affected sites. It is crucial to update Drupal to the patched versions and review any custom or contributed code that calls the user_save function. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) used to build websites and applications.
Drupal versions 6.x before 6.38 and 7.x before 7.43 are affected.
This vulnerability allows remote attackers to gain unauthorized privileges, potentially leading to administrative access and unauthorized actions on the affected Drupal site.
No, there are no known workarounds for this vulnerability. Updating Drupal to the patched versions is the recommended solution.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Drupal site is affected by this vulnerability. It analyzes your composer.lock file and provides real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
