Drupal External URL Injection through URL Aliases Leading to Open Redirect
Summary
GHSA-7f4f-p7mq-p4fv: Drupal External URL injection through URL aliases leading to Open Redirect. Affects drupal/core across 3 version ranges.
>= 7.0, < 7.60
>= 8.0.0, < 8.5.8
>= 8.6.0, < 8.6.2
Fixed in 7.60, 8.5.8 or 8.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular content management system (CMS) that allows users to create and manage websites. The path module in Drupal enables users with the 'administer paths' permission to create user-friendly URLs for content. This feature allows for the creation of pretty URLs that are easier to remember and share. However, in certain circumstances, a user with the 'administer paths' permission can enter a specific path that triggers an open redirect to a malicious URL.
Vulnerability Detail
The vulnerability in Drupal allows an attacker with the 'administer paths' permission to inject an external URL through URL aliases, leading to an open redirect. By manipulating the URL alias, an attacker can redirect users to a malicious website, potentially tricking them into disclosing sensitive information or performing unintended actions. This vulnerability poses a moderate risk and can be exploited by an authenticated user with the necessary permission.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0, < 7.607.60composer require drupal/core:7.60 -
>= 8.0.0, < 8.5.88.5.8composer require drupal/core:8.5.8 -
>= 8.6.0, < 8.6.28.6.2composer require drupal/core:8.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround for this vulnerability. However, administrators can mitigate the risk by carefully managing user permissions and restricting the 'administer paths' permission to trusted users only. Additionally, it is important to monitor and review URL aliases created by users to identify any suspicious or potentially malicious redirects.
Conclusion
The Drupal External URL Injection vulnerability through URL aliases leading to open redirect can be mitigated by updating Drupal to the latest version available. Administrators should also carefully manage user permissions and monitor URL aliases for any suspicious activity. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
This vulnerability allows an attacker to redirect users to a malicious website, potentially leading to the disclosure of sensitive information or unintended actions.
Drupal versions 7.0 to 7.60, 8.0.0 to 8.5.8, and 8.6.0 to 8.6.2 are affected by this vulnerability. Administrators with the 'administer paths' permission are particularly at risk.
No, this vulnerability requires an authenticated user with the 'administer paths' permission to exploit it.
Yes, the vulnerability has been fixed in Drupal versions 7.60, 8.5.8, and 8.6.2. It is recommended to update to these versions or later to mitigate the risk.
There are no known instances of this vulnerability being actively exploited in the wild. However, it is important to apply the necessary updates and security patches to protect against potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
