CVE-2020-13665: Access Bypass Vulnerability in Drupal Core
Summary
CVE-2020-13665: Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Affects drupal across 3 version ranges.
>= 8.8.0, < 8.8.8
>= 8.9.0, < 8.9.1
>= 9.0.0, < 9.0.1
Fixed in 8.8.8, 8.9.1 or 9.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- drupal/core · Packagist
The same CVE-2020-13665 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) that allows users to easily create and manage websites. It provides a wide range of features and functionality, making it a popular choice for building websites of all sizes. However, Drupal Core versions 8.8.x, 8.9.x, and 9.0.x are vulnerable to an access bypass vulnerability when JSON:API is in read/write mode. This vulnerability can be exploited if the 'read_only' setting is set to FALSE under the 'jsonapi.settings' configuration. The vulnerability allows unauthorized users to bypass access restrictions and perform actions that should be restricted to authenticated users.
Vulnerability Detail
The access bypass vulnerability in Drupal Core allows unauthorized users to bypass access restrictions and perform actions that should be restricted to authenticated users. This vulnerability affects Drupal Core versions 8.8.x, 8.9.x, and 9.0.x. Only sites that have the 'read_only' setting set to FALSE under the 'jsonapi.settings' configuration are vulnerable. The vulnerability exists in the JSON:API functionality when it is in read/write mode. An attacker can exploit this vulnerability to gain unauthorized access and perform actions that should be restricted to authenticated users. The impact of this vulnerability can be severe, as it allows attackers to manipulate data, modify content, and potentially compromise the integrity and security of the affected Drupal websites.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.8.0, < 8.8.88.8.8 -
>= 8.9.0, < 8.9.18.9.1 -
>= 9.0.0, < 9.0.19.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Drupal Core is not immediately possible, a temporary workaround can be implemented by manually setting the 'read_only' setting to TRUE under the 'jsonapi.settings' configuration. This can be done by modifying the configuration file directly or using the Drupal administrative interface. By setting the 'read_only' setting to TRUE, the vulnerability is mitigated as it restricts the JSON:API functionality to read-only mode, preventing unauthorized users from performing actions that should be restricted to authenticated users.
Conclusion
The access bypass vulnerability in Drupal Core can have severe consequences, allowing unauthorized users to bypass access restrictions and perform actions that should be restricted to authenticated users. It is crucial to update Drupal Core to the latest version and review the 'jsonapi.settings' configuration to ensure the 'read_only' setting is properly enforced. By taking these steps, the risk of unauthorized access and potential compromise of the affected Drupal websites can be significantly mitigated. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your Drupal site is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it to identify any open-source vulnerabilities, including this access bypass vulnerability.
The impact of this vulnerability can be severe, as it allows unauthorized users to bypass access restrictions and perform actions that should be restricted to authenticated users. Attackers can manipulate data, modify content, and potentially compromise the integrity and security of the affected Drupal websites.
Yes, patches are available to fix this vulnerability. It is recommended to update Drupal Core to the latest version, which includes the necessary patches to address this vulnerability.
There have been no known instances of this vulnerability being exploited in the wild. However, it is important to apply the necessary patches and updates to mitigate the risk of exploitation.
This vulnerability was discovered by the Drupal Security Team during routine security audits and assessments.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
