CVE-2020-13665: Drupal Core JSON:API PATCH Request Validation Bypass Vulnerability
Summary
CVE-2020-13665 : JSON:API PATCH requests may bypass validation for certain fields. Affects drupal/core across 3 version ranges.
>= 8.0.0, < 8.8.8
>= 8.9.0, < 8.9.1
>= 9.0.0, < 9.0.1
Fixed in 8.8.8, 8.9.1 or 9.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that enables users to build and manage websites and applications. It provides a flexible framework for developers to create custom modules and themes. The JSON:API module in Drupal allows for the creation of APIs that adhere to the JSON:API specification, facilitating data exchange between the client and server. However, a vulnerability was discovered in the PATCH request handling of the JSON:API module, which could lead to unauthorized data manipulation if not properly configured.
Vulnerability Detail
The vulnerability arises from the JSON:API PATCH requests that may bypass validation for certain fields. This issue is particularly concerning for sites that have the read_only setting configured to FALSE under jsonapi.settings. In such cases, an attacker could exploit this vulnerability to modify data in ways that should not be permitted, potentially leading to data integrity issues and unauthorized access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.8.88.8.8composer require drupal/core:8.8.8 -
>= 8.9.0, < 8.9.18.9.1composer require drupal/core:8.9.1 -
>= 9.0.0, < 9.0.19.0.1composer require drupal/core:9.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot immediately update your Drupal installation, a temporary workaround is to set the read_only configuration to TRUE under jsonapi.settings. This will prevent PATCH requests from modifying data, thus mitigating the risk associated with this vulnerability.
Conclusion
The CVE-2020-13665 vulnerability in Drupal Core's JSON:API module poses a significant risk to sites that allow PATCH requests without proper validation. It is crucial to update to the patched versions to safeguard against potential data manipulation attacks. Additionally, implementing the recommended workaround can provide temporary protection until an update can be performed.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2020-13665 is a vulnerability in Drupal Core's JSON:API module that allows PATCH requests to bypass validation for certain fields, potentially leading to unauthorized data manipulation.
Only Drupal sites that have the read_only setting set to FALSE under jsonapi.settings are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
As a temporary measure, you can set the read_only configuration to TRUE under jsonapi.settings to prevent PATCH requests from modifying data.
You can update your Drupal installation using Composer with the appropriate command for your version. For example, use composer require 'drupal/core:^8.8.8' --update-with-dependencies for version 8.8.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
