Drupal Anonymous Open Redirect Vulnerability in drupal/core
Summary
GHSA-gfvf-2f25-f34r: Drupal Anonymous Open Redirect. Affects drupal/core across 2 version ranges.
>= 8.0.0, < 8.5.8
>= 8.6.0, < 8.6.2
Fixed in 8.5.8 or 8.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications. The drupal/core package is a fundamental component of Drupal, providing core functionality and features. However, a vulnerability has been discovered in Drupal core and contributed modules that allows malicious users to construct URLs with a manipulated "destination" query string parameter, leading to potential open redirects and exposing users to social engineering attacks.
Vulnerability Detail
The Drupal Anonymous Open Redirect vulnerability arises from the improper handling of the "destination" query string parameter in URLs. This parameter is commonly used in Drupal to redirect users to a new destination after completing an action on the current page. However, under certain circumstances, attackers can exploit this parameter to craft URLs that trick users into being redirected to a third-party website. This can potentially lead to social engineering attacks, where users are deceived into divulging sensitive information or performing unintended actions on the malicious site.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.5.88.5.8composer require drupal/core:8.5.8 -
>= 8.6.0, < 8.6.28.6.2composer require drupal/core:8.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is crucial to apply the recommended fix by updating Drupal core and contributed modules to the patched versions.
Conclusion
The Drupal Anonymous Open Redirect vulnerability in drupal/core and contributed modules can potentially expose users to social engineering attacks. It is important to update Drupal core and modules to the patched versions (8.5.8 or 8.6.2) to mitigate this vulnerability. Regularly updating Drupal and following secure coding practices are essential for maintaining the security of your website. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) used for building websites and web applications. It provides a flexible and extensible platform for managing digital content.
The "destination" query string parameter is commonly used in Drupal to redirect users to a specific destination after completing an action. It helps in providing a seamless user experience by directing users to the appropriate page.
Attackers can exploit this vulnerability by manipulating the "destination" query string parameter in URLs. They can craft URLs that trick users into being redirected to a malicious third-party website, potentially leading to social engineering attacks.
The Drupal Anonymous Open Redirect vulnerability can expose users to social engineering attacks, where they may be tricked into divulging sensitive information or performing unintended actions on a malicious site. This can result in financial loss, identity theft, or other forms of exploitation.
To protect your Drupal website, it is crucial to regularly update Drupal core and contributed modules to the latest patched versions. This ensures that security vulnerabilities, including the Drupal Anonymous Open Redirect vulnerability, are addressed. Additionally, following secure coding practices and implementing proper access controls can further enhance the security of your Drupal installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
