Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
Summary
GHSA-7v68-3pr5-h3cr: Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution. Affects drupal/core across 2 version ranges.
>= 8.0.0, < 8.5.8
>= 8.6.0, < 8.6.2
Fixed in 8.5.8 or 8.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Core is a popular content management system (CMS) used to build websites and applications. It provides a wide range of features and functionality for creating and managing digital content. The Contextual Links module is a part of Drupal Core and allows users to easily edit and manage content by providing contextual links. These links appear when hovering over specific elements on a webpage and provide quick access to relevant editing options. However, a vulnerability in the module's validation process can be exploited by attackers to execute remote code on the affected Drupal installation.
Vulnerability Detail
The vulnerability in the Contextual Links module arises from insufficient validation of requested contextual links. This means that an attacker with a role that has the permission 'access contextual links' can craft a malicious request to execute arbitrary code on the server. The lack of proper validation allows the attacker to bypass security measures and gain unauthorized access to the system. This vulnerability is considered critical as it can lead to a complete compromise of the affected Drupal installation, potentially exposing sensitive data and allowing further attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.5.88.5.8composer require drupal/core:8.5.8 -
>= 8.6.0, < 8.6.28.6.2composer require drupal/core:8.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general security practice, it is advisable to restrict the permissions of user roles to minimize the potential impact of any vulnerabilities. In this case, limiting the 'access contextual links' permission to only trusted roles can help mitigate the risk of exploitation.
Conclusion
The vulnerability in Drupal Core's Contextual Links module can lead to remote code execution and compromise of the affected installation. It is crucial to update to the patched versions provided by the Drupal security team to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal Core is a content management system (CMS) used for building websites and applications. It provides a range of features and functionality for managing digital content.
The Contextual Links module is a part of Drupal Core that allows users to easily edit and manage content by providing contextual links. These links appear when hovering over specific elements on a webpage and provide quick access to relevant editing options.
The vulnerability in the Contextual Links module allows attackers to execute remote code on the affected Drupal installation. This can lead to unauthorized access, data exposure, and further compromise of the system.
An attacker must have a role with the permission 'access contextual links' to exploit this vulnerability. Restricting this permission to trusted roles can help mitigate the risk.
To fix this vulnerability, update your Drupal Core installation to the patched versions provided by the Drupal security team. For versions 8.0.0 to 8.5.8, update to version 8.5.9 or later. For versions 8.6.0 to 8.6.2, update to version 8.6.3 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
