CVE-2024-45440: Drupal Full Path Disclosure
Summary
CVE-2024-45440: Drupal Full Path Disclosure. Affects drupal/drupal across 3 version ranges.
>= 8.0.0, < 10.2.9
>= 10.3.0, < 10.3.6
>= 11.0.0, < 11.0.5
Fixed in 10.2.9, 10.3.6 or 11.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) used for building websites and applications. It provides a flexible platform for creating and managing digital content. The vulnerability in question affects Drupal versions 11.x-dev. Drupal uses a file called authorize.php for authorization purposes. This file is susceptible to a Full Path Disclosure vulnerability, which means that an attacker can obtain the full path of the server's file system. This vulnerability can be exploited even when error logging is disabled, making it more difficult to detect.
Vulnerability Detail
The vulnerability arises when the value of the hash_salt variable in authorize.php is set to the result of file_get_contents of a non-existent file. This can be leveraged by an attacker to disclose sensitive information about the server's file system structure. By exploiting this vulnerability, an attacker can gain insights into the server's directory structure, potentially aiding in further attacks or information disclosure. The impact of this vulnerability is considered low, but it still poses a risk to the confidentiality of sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.2.910.2.9composer require drupal/drupal:10.2.9 -
>= 10.3.0, < 10.3.610.3.6composer require drupal/drupal:10.3.6 -
>= 11.0.0, < 11.0.511.0.5composer require drupal/drupal:11.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually set the hash_salt variable in authorize.php to a static value instead of using file_get_contents. This will prevent the disclosure of the full path. However, this is not a recommended long-term solution, and it is strongly advised to apply the official patch or update to a fixed version of Drupal.
Conclusion
The Full Path Disclosure vulnerability in Drupal 11.x-dev allows an attacker to obtain the full path of the server's file system. While the impact is considered low, it still poses a risk to the confidentiality of sensitive information. Users are advised to update to a patched version of Drupal and enable error logging to mitigate this vulnerability.
See every vulnerability recorded for drupal/drupal →
FAQ
Drupal is an open-source content management system used for building websites and applications.
Full Path Disclosure is a vulnerability that allows an attacker to obtain the full path of a server's file system.
By manipulating the hash_salt variable in authorize.php, an attacker can trigger the Full Path Disclosure vulnerability and obtain sensitive information about the server's file system.
The impact of this vulnerability is considered low, but it can potentially aid attackers in further attacks or information disclosure.
To fix this vulnerability, it is recommended to update to a patched version of Drupal and ensure that error logging is enabled.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/drupal.
