CVE-2024-13281: Drupal Monster Menus Module Access Control Vulnerability
Summary
CVE-2024-13281: This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. Affects drupal/monster_menus versions < 9.3.2. Fixed in 9.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Drupal Monster Menus module allows users to create and manage complex menu structures with a highly-granular permissions system. It is designed to enhance the user experience by providing flexible navigation options within Drupal sites. However, due to a flaw in its function mm_content_get_uids_in_group(), the module can inadvertently grant excessive access to content under specific conditions, particularly when custom code interacts with it improperly.
Vulnerability Detail
The vulnerability arises from a function that does not return valid data when called with a specific parameter—a UID of zero (0). This can lead to third-party code mistakenly granting access to users who should not have it, potentially exposing sensitive content. The issue is particularly concerning for sites that rely on this function for access control, as it undermines the intended permissions structure.
How To Fix
Minimum fixed version
9.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the mm_content_get_uids_in_group() function with a UID of zero (0) in your custom code. Review your codebase to ensure that this function is not invoked with this parameter until the module is updated.
Conclusion
The CVE-2024-13281 vulnerability in the Drupal Monster Menus module poses a significant risk to access control on affected sites. It is crucial for site administrators to update to the patched version to mitigate this risk and ensure that their content remains secure.
See every vulnerability recorded for drupal/monster_menus →
FAQ
CVE-2024-13281 is a vulnerability in the Drupal Monster Menus module that can lead to improper access control, allowing unauthorized users to access content.
Sites using the Drupal Monster Menus module with custom code that calls the mm_content_get_uids_in_group() function with a UID of zero (0) are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the module right away, ensure that your custom code does not call the mm_content_get_uids_in_group() function with a UID of zero (0) as a temporary measure.
More information can be found in the advisory published by the Drupal Security Team, which details the vulnerability and its implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/monster_menus.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
