Drupal External URL Injection through URL Aliases Leading to Open Redirect
Summary
GHSA-r67r-42wx-c8r7: Drupal External URL injection through URL aliases leading to Open Redirect. Affects drupal/drupal across 3 version ranges.
>= 7.0, < 7.60
>= 8.0.0, < 8.5.8
>= 8.6.0, < 8.6.2
Fixed in 7.60, 8.5.8 or 8.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular content management system (CMS) that allows users to create and manage websites. It provides various modules, including the path module, which enables users with the 'administer paths' permission to create user-friendly URLs for content. This feature allows for the creation of pretty URLs that can be easily remembered and shared. However, a vulnerability in the path module allows users to enter a specific path that triggers an open redirect to a malicious URL.
Vulnerability Detail
The vulnerability in Drupal's path module allows users with the 'administer paths' permission to inject external URLs through URL aliases. This can lead to an open redirect vulnerability, where an attacker can craft a URL that redirects users to a malicious website. This can be used for phishing attacks, spreading malware, or other malicious activities. The vulnerability affects Drupal versions 7.0 to 7.60, 8.0.0 to 8.5.8, and 8.6.0 to 8.6.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0, < 7.607.60composer require drupal/drupal:7.60 -
>= 8.0.0, < 8.5.88.5.8composer require drupal/drupal:8.5.8 -
>= 8.6.0, < 8.6.28.6.2composer require drupal/drupal:8.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the necessary updates as soon as possible.
Conclusion
The Drupal path module vulnerability allows users with the 'administer paths' permission to inject external URLs through URL aliases, leading to an open redirect vulnerability. To mitigate this issue, it is crucial to update Drupal to the latest patched version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/drupal →
FAQ
This vulnerability allows an attacker to redirect users to a malicious website, potentially leading to phishing attacks, malware infections, or other malicious activities.
Users of Drupal versions 7.0 to 7.60, 8.0.0 to 8.5.8, and 8.6.0 to 8.6.2 are affected by this vulnerability if they have the 'administer paths' permission.
You can use the Vulert Playground at Vulert Scanner to check if your Drupal installation is affected by this vulnerability. Simply provide your composer.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to apply the necessary updates to protect against potential attacks.
You can find more information about this vulnerability, including the technical details and the fixed versions, in the advisory on GitHub: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/drupal.
