CVE-2017-6921: Drupal file REST resource does not properly validate
Summary
CVE-2017-6921: Drupal file REST resource does not properly validate. Affects drupal/core versions >= 8.0, < 8.3.4. Fixed in 8.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal is a popular open-source content management system (CMS) used for building websites and applications. It provides a wide range of features and functionality for creating and managing digital content. The file REST resource in Drupal allows users to manipulate files through RESTful web services. However, prior to version 8.3.4, the file REST resource did not properly validate certain fields when handling file uploads and modifications. This vulnerability can be exploited if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can register a user account with the necessary permissions.
Vulnerability Detail
The vulnerability in the file REST resource of Drupal allows an attacker to upload and modify files without proper validation. This can lead to various security issues, such as unauthorized access to sensitive files, execution of arbitrary code, and potential compromise of the entire Drupal site. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Minimum fixed version
8.3.4
This is the first release that contains the fix.
composer require drupal/core:8.3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Drupal is not immediately feasible, a temporary workaround is to disable the file REST resource or restrict access to it. This can be done by disabling the RESTful Web Services (rest) module or configuring access permissions to limit file manipulation capabilities to trusted users only. However, it is strongly recommended to apply the official fix by upgrading Drupal as soon as possible.
Conclusion
The Drupal file REST resource vulnerability (CVE-2017-6921) poses a moderate risk to Drupal sites that have the RESTful Web Services (rest) module enabled and allow PATCH requests. Upgrading to Drupal version 8.3.4 or later is the recommended solution to address this vulnerability. Site administrators should also review user permissions and consider disabling the file REST resource if not needed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
The vulnerability allows an attacker to upload and modify files without proper validation, potentially leading to unauthorized access, code execution, and compromise of the Drupal site.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file to the playground and it will alert you if the vulnerability is present.
Yes, this vulnerability can be exploited remotely if the site has the RESTful Web Services (rest) module enabled and allows PATCH requests. An attacker can register a user account and manipulate files through the file REST resource.
The recommended mitigation is to upgrade Drupal to version 8.3.4 or later. Disabling the file REST resource or restricting access to it can also provide temporary protection.
There is no specific evidence of active exploits targeting this vulnerability at the moment. However, it is always advisable to apply security patches and updates promptly to minimize the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
