Drupal Anonymous Open Redirect in drupal/drupal

Background

Drupal is a popular open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications. The drupal/drupal package is the core package of Drupal that provides the fundamental functionality and features of the CMS. This vulnerability affects versions 8.0.0 to 8.5.8 and versions 8.6.0 to 8.6.2 of the drupal/drupal package. The vulnerability allows malicious users to construct URLs with a manipulated 'destination' query string parameter, leading to potential social engineering attacks.

Vulnerability Detail

The Drupal Anonymous Open Redirect vulnerability arises from the usage of the 'destination' query string parameter in URLs by Drupal core and contributed modules. This parameter is commonly used to redirect users to a new destination after completing an action on the current page. However, under certain circumstances, attackers can exploit this parameter to craft URLs that trick users into being redirected to a third-party website. This exposes users to potential social engineering attacks, where they may be deceived into divulging sensitive information or performing unintended actions.

Workaround

As a temporary workaround, developers can manually validate and sanitize the 'destination' query string parameter in their code. This can be done by checking the URL against a whitelist of allowed destinations or by using a regular expression to ensure the URL follows the expected format. Here is an example of how to sanitize the 'destination' parameter in PHP:

$destination = $_GET['destination'];

if (preg_match('/^/[a-zA-Z0-9/]+$/', $destination)) {
    // Valid destination, proceed with redirection
    header('Location: ' . $destination);
    exit;
} else {
    // Invalid destination, handle error
    echo 'Invalid destination';
}

Conclusion

The Drupal Anonymous Open Redirect vulnerability in the drupal/drupal package allows attackers to manipulate the 'destination' query string parameter and redirect users to malicious websites. Upgrading to the latest version of the package is recommended to fix the vulnerability. In the meantime, developers can implement a temporary workaround by manually validating and sanitizing the 'destination' parameter in their code. For further assistance with vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for drupal/drupal →

FAQ