Drupal Cross-Site Request Forgery (CSRF) in drupal/core and drupal/drupal
Summary
CVE-2017-6379: Drupal Cross-Site Request Forgery (CSRF). Affects drupal/core versions >= 8.2.0, < 8.2.7. Fixed in 8.2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) used for building websites and applications. The drupal/core and drupal/drupal packages are essential components of Drupal. They provide core functionalities and features for the CMS. However, versions 8.2.0 to 8.2.6 of these packages are vulnerable to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The CSRF vulnerability in Drupal allows an attacker to perform unauthorized actions on behalf of authenticated users. In this specific case, some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection against CSRF attacks. This vulnerability could be exploited by an attacker to disable certain blocks on a targeted Drupal site. Although the attacker would need to know the block ID, this issue still poses a significant risk to the affected sites.
How To Fix
Minimum fixed version
8.2.7
This is the first release that contains the fix.
composer require drupal/core:8.2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to apply the available security update.
Conclusion
The CSRF vulnerability in Drupal 8.2.x before 8.2.7 exposes affected sites to the risk of unauthorized actions performed by attackers. To mitigate this risk, it is crucial to update the Drupal installation to version 8.2.7 or later. For further support and assistance with vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) used for building websites and applications. It provides a flexible and extensible framework for managing digital content.
Cross-Site Request Forgery (CSRF) is a type of attack where an attacker tricks a victim into performing unwanted actions on a web application. In the context of Drupal, this vulnerability allows an attacker to perform unauthorized actions on behalf of authenticated users.
This vulnerability allows an attacker to disable certain blocks on a Drupal site. While the attacker needs to know the block ID, it still poses a risk to affected sites as it can disrupt the site's functionality and user experience.
You can use Vulert's playground at Vulert Scanner to check if your Drupal installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
You can find more information about this vulnerability, including technical details and the fix, in the advisory published on GitHub: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gxxq-fhc7-3jv9/GHSA-gxxq-fhc7-3jv9.json
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
