CVE-2020-13663: Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
Summary
CVE-2020-13663: Drupal Core Cross-Site Request Forgery (CSRF) vulnerability. Affects drupal/core across 4 version ranges.
>= 7.0.0, < 7.72
>= 8.0.0, < 8.8.8
>= 8.9.0, < 8.9.1
>= 9.0.0, < 9.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2020-13663 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Core is a content management system (CMS) that allows users to create and manage websites. It provides a wide range of features and functionalities for building and maintaining web applications. However, Drupal Core is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in its Form API. This vulnerability occurs when the Form API does not properly handle certain form input from cross-site requests. As a result, it can lead to other vulnerabilities and potentially allow attackers to perform unauthorized actions on behalf of authenticated users.
Vulnerability Detail
The Cross-Site Request Forgery (CSRF) vulnerability in Drupal Core Form API can be exploited by attackers to trick authenticated users into unknowingly performing malicious actions. By crafting a specially crafted request, an attacker can deceive the user's browser into making a request to a vulnerable Drupal site, leading to the execution of unauthorized actions. This vulnerability can have severe consequences, including unauthorized data modification, privilege escalation, and potential compromise of the entire Drupal installation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.727.72composer require drupal/core:7.72 -
>= 8.0.0, < 8.8.88.8.8composer require drupal/core:8.8.8 -
>= 8.9.0, < 8.9.18.9.1composer require drupal/core:8.9.1 -
>= 9.0.0, < 9.0.19.0.1composer require drupal/core:9.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Drupal Core to the patched versions mentioned above to address the CSRF vulnerability effectively.
Conclusion
The Cross-Site Request Forgery (CSRF) vulnerability in Drupal Core Form API can have severe consequences, including unauthorized data modification and potential compromise of the entire Drupal installation. It is crucial to update Drupal Core to the latest patched versions (7.72, 8.8.8, 8.9.1, or 9.0.1) to mitigate the risk of CSRF attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Cross-Site Request Forgery (CSRF) is a type of attack that tricks authenticated users into unknowingly performing actions on a website without their consent or knowledge. It occurs when a malicious website or attacker can make a user's browser execute unwanted actions on another site where the user is authenticated.
An attacker can craft a malicious request and trick an authenticated user into visiting a specially crafted webpage or clicking on a malicious link. When the user's browser makes a request to the vulnerable Drupal site, the attacker's request is executed, leading to unauthorized actions.
The CSRF vulnerability in Drupal Core can have severe consequences, including unauthorized data modification, privilege escalation, and potential compromise of the entire Drupal installation. Attackers can perform actions on behalf of authenticated users, leading to data breaches, unauthorized access, and other security issues.
Yes, Drupal Core has released patches to address the CSRF vulnerability. It is crucial to update Drupal Core to the latest patched versions (7.72, 8.8.8, 8.9.1, or 9.0.1) to mitigate the risk of CSRF attacks.
You can use Vulert's vulnerability monitoring service to check if your Drupal installation is affected by this vulnerability. Vulert uses composer.lock to monitor and alert in real-time for open-source vulnerabilities in software. Visit the Vulert playground at Vulert Scanner to check if your application is affected.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
