SA-CONTRIB-2010-065 - Content Construction Kit (CCK) - Access Bypass

By Drupal Security Team on 16 Jun 2010 at 20:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-065
Project: Content Construction Kit (CCK) (third-party module)
Version: 5.x, 6.x
Date: 2010-June-16
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

Description

The Content Construction Kit (CCK) project is a set of modules that allows you to add custom fields to nodes using a web browser.

The CCK "Node Reference" module can be configured to display referenced nodes as hidden, title, teaser or full view. Node access was not checked when displaying these which could expose view access on controlled nodes to unprivileged users.

In addition, Node Reference provides a backend URL that is used for asynchronous requests by the "autocomplete" widget to locate nodes the user can reference. This was not checking that the user had field level access to the source field, allowing direct queries to the backend URL to return node titles and IDs which the user would otherwise be unable to access. Note that as Drupal 5 CCK does not have any field access control functionality, this issue only applies to the Drupal 6 version.

Versions affected

Content Construction Kit (CCK) module for Drupal 5.x versions prior to 5.x-1.11
Content Construction Kit (CCK) module for Drupal 6.x versions prior to 6.x-2.7

Drupal core is not affected. If you do not use the contributed Content Construction Kit (CCK) module, together with any node or field access module there is nothing you need to do.

Solution

Install the latest version:

If you use the Content Construction Kit (CCK) module for Drupal 5.x upgrade to ~~Content Construction Kit (CCK) 5.x-1.11~~ Edit: the 5.x-1.11 version had a critical error. It is suggested to upgrade to the 5.x-1.12 version
If you use the Content Construction Kit (CCK) module for Drupal 6.x upgrade to Content Construction Kit (CCK) 6.x-2.7