Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
Summary
GHSA-jjx7-8462-w4m4: Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution. Affects drupal/drupal across 2 version ranges.
>= 8.0.0, < 8.5.8
>= 8.6.0, < 8.6.2
Fixed in 8.5.8 or 8.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The Contextual Links module is a part of Drupal Core and allows users to easily edit and manage content by providing contextual links. These links appear when hovering over specific elements on a webpage. However, a vulnerability has been discovered in the module's validation process, which could potentially lead to remote code execution.
Vulnerability Detail
The Contextual Links module in Drupal Core does not adequately validate requested contextual links. This means that an attacker with a role that has the 'access contextual links' permission could exploit this vulnerability. By crafting a malicious request, an attacker could execute arbitrary code on the affected Drupal site. The impact of this vulnerability is critical as it allows an attacker to gain unauthorized access and potentially take control of the entire website.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.5.88.5.8composer require drupal/drupal:8.5.8 -
>= 8.6.0, < 8.6.28.6.2composer require drupal/drupal:8.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Drupal Core to the patched version as soon as possible.
Conclusion
The Drupal Core Insufficient Contextual Links validation vulnerability poses a significant risk to websites and applications using affected versions of Drupal Core. It is crucial to update to the patched versions mentioned above to mitigate the vulnerability and ensure the security of the system. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/drupal →
FAQ
Drupal Core is the foundational software of the Drupal CMS. It provides essential features and functionality for building websites and applications.
The Contextual Links module is a part of Drupal Core that allows users to easily edit and manage content by providing contextual links.
Remote code execution refers to the ability of an attacker to execute arbitrary code on a target system or application remotely, without having physical access to the system.
An attacker must have a role with the 'access contextual links' permission to exploit this vulnerability.
The impact of this vulnerability is critical as it allows an attacker to execute arbitrary code on the affected Drupal site, potentially gaining unauthorized access and control.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/drupal.
