CVE-2017-6930: Drupal Core - Access Bypass Vulnerability
Summary
CVE-2017-6930: Drupal access bypass vulnerability. Affects drupal/core versions >= 8.4.0, < 8.4.5. Fixed in 8.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) used for building websites and applications. It provides a flexible and extensible framework for creating and managing digital content. Drupal Core is the foundational package that includes essential features and functionality for running a Drupal site. It is widely adopted and maintained by the Drupal community. However, a vulnerability has been discovered in Drupal Core versions 8.4.x before 8.4.5 that allows for access bypass.
Vulnerability Detail
The vulnerability arises when using node access controls with a multilingual site in Drupal. In such cases, Drupal designates the untranslated version of a node as the default fallback for access queries. This means that if a translated version of a node is not available, the untranslated version will be used for access checks. This can lead to an access bypass vulnerability, as unauthorized users may gain access to content that should be restricted. The vulnerability is mitigated by the fact that it only affects sites using the Content Translation module and a node access module like Domain Access that implements hook_node_access_records(). The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
8.4.5
This is the first release that contains the fix.
composer require drupal/core:8.4.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate update to Drupal Core 8.4.5 is not possible, a temporary workaround can be implemented by disabling the Content Translation module and any node access modules that use hook_node_access_records(). This will prevent the access bypass vulnerability from being exploited. However, it is important to note that this workaround may impact the multilingual functionality and access control features of the affected site. Therefore, it is strongly advised to apply the official patch as soon as possible.
Conclusion
The access bypass vulnerability in Drupal Core versions 8.4.x before 8.4.5 poses a significant risk to affected Drupal sites using multilingual features. To protect your site and prevent unauthorized access to restricted content, it is crucial to update Drupal Core to version 8.4.5 or later. If immediate update is not possible, consider applying the temporary workaround by disabling the Content Translation module and affected node access modules. For further assistance and guidance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Drupal site is affected by this vulnerability. Vulert analyzes your composer.lock file and provides real-time alerts for open-source vulnerabilities, including this specific Drupal Core vulnerability.
The vulnerability allows unauthorized users to bypass access controls and gain access to restricted content on affected Drupal sites. This can lead to unauthorized data exposure and potential security breaches.
No, the vulnerability only affects Drupal sites that use the Content Translation module and a node access module that implements hook_node_access_records(). If your site does not meet these criteria, it is not vulnerable to this specific issue.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is important to apply the recommended security updates to mitigate the risk of exploitation.
While applying the workaround by disabling the Content Translation module and affected node access modules can temporarily mitigate the vulnerability, it is strongly recommended to update Drupal Core to the latest version. Updates include important security patches and ensure the long-term security and stability of your Drupal site.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
