CVE-2017-6919: Drupal access control bypass vulnerability
Summary
CVE-2017-6919: Drupal access control bypass vulnerability. Affects drupal/core across 2 version ranges.
>= 8.0, < 8.2.8
>= 8.3.0, < 8.3.1
Fixed in 8.2.8 or 8.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The Drupal core package is the foundation of the CMS and includes essential features and functionality. The vulnerability identified as CVE-2017-6919 affects Drupal versions 8 before 8.2.8 and 8.3 before 8.3.1. It specifically impacts sites that have the RESTful Web Services (rest) module enabled and allow PATCH requests. This vulnerability allows authenticated users to bypass critical access controls.
Vulnerability Detail
The CVE-2017-6919 vulnerability in Drupal allows authenticated users to bypass access controls if the site has the RESTful Web Services (rest) module enabled and allows PATCH requests. This means that even users with limited privileges can gain unauthorized access to sensitive information or perform actions that should be restricted. The vulnerability has a CVSS score of 7.5, indicating a high severity level. It is crucial to address this vulnerability promptly to prevent potential unauthorized access and data breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0, < 8.2.88.2.8composer require drupal/core:8.2.8 -
>= 8.3.0, < 8.3.18.3.1composer require drupal/core:8.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to disable the RESTful Web Services (rest) module. This can be done by accessing the Drupal administration panel, navigating to the 'Extend' section, finding the 'RESTful Web Services' module, and disabling it. Disabling the module will prevent the exploitation of the vulnerability, but it may impact any functionality relying on the RESTful Web Services feature. It is still recommended to update Drupal to the fixed versions as soon as possible.
Conclusion
The CVE-2017-6919 vulnerability in Drupal poses a significant risk to sites that have the RESTful Web Services (rest) module enabled and allow PATCH requests. It allows authenticated users to bypass access controls and potentially gain unauthorized access to sensitive information or perform restricted actions. It is crucial to update Drupal to the fixed versions or disable the vulnerable module as a temporary workaround. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications.
The RESTful Web Services (rest) module in Drupal allows developers to expose Drupal's functionality as RESTful web services. It enables integration with other systems and applications.
The CVE-2017-6919 vulnerability allows authenticated users to bypass access controls in Drupal if the RESTful Web Services (rest) module is enabled and allows PATCH requests. This can lead to unauthorized access to sensitive information or actions that should be restricted.
The CVE-2017-6919 vulnerability has a CVSS score of 7.5, indicating a high severity level.
To fix the CVE-2017-6919 vulnerability, it is recommended to update Drupal to version 8.2.8 or 8.3.1, depending on the installed version. Alternatively, you can temporarily disable the RESTful Web Services (rest) module until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
