Drupal core Access control bypass in Media Library module
Summary
GHSA-5x28-3f32-x523: Drupal core Access control bypass. Affects drupal/drupal across 2 version ranges.
>= 8.0.0, < 8.7.11
>= 8.8.0, < 8.8.1
Fixed in 8.7.11 or 8.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) used for building websites and applications. The Media Library module is a core component of Drupal that provides a user interface for managing media items such as images, videos, and documents. It allows users to upload, organize, and display media files on their Drupal site. However, a security vulnerability has been discovered in the Media Library module that can lead to access control bypass in certain configurations.
Vulnerability Detail
The vulnerability in the Media Library module allows unauthorized users to gain access to media items that they should not have permission to view. This can occur when the module is configured in a way that doesn't sufficiently restrict access to media items. An attacker could exploit this vulnerability to view sensitive media files or perform unauthorized actions on them. The impact of this vulnerability depends on the sensitivity of the media files and the permissions of the affected user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.118.7.11composer require drupal/drupal:8.7.11 -
>= 8.8.0, < 8.8.18.8.1composer require drupal/drupal:8.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Alternatively, if you are unable to immediately upgrade to the latest version of Drupal, you can mitigate this vulnerability by unchecking the "Enable advanced UI" checkbox on the Media Library configuration page (/admin/config/media/media-library). Please note that this workaround is not available in Drupal 8.7.x.
Conclusion
The Drupal core Media Library module has a security vulnerability that allows access control bypass. To mitigate this vulnerability, it is recommended to upgrade to the latest version of Drupal or apply the provided workaround. It is important to address this vulnerability promptly to prevent unauthorized access to sensitive media files. For additional support and guidance, contact DevNack.com.
See every vulnerability recorded for drupal/drupal →
FAQ
The impact of this vulnerability depends on the sensitivity of the media files and the permissions of the affected user. An attacker could potentially view sensitive media files or perform unauthorized actions on them.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Drupal site is affected by this vulnerability. Simply upload your composer.lock file to the playground and it will analyze your dependencies for any known vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to patch your Drupal installation as soon as possible to prevent any potential exploitation.
No, the workaround of unchecking the "Enable advanced UI" checkbox is not available in Drupal 8.7.x. It is recommended to upgrade to the latest version of Drupal to fix this vulnerability.
For further support and assistance in remediation of this vulnerability, you can reach out to info@devnack.com. They have expertise in Drupal security and can provide guidance on patching and securing your Drupal installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/drupal.
