By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2013-079
  • Project: Context (third-party module)
  • Version: 6.x, 7.x
  • Date: 2013-2013-16
  • Security risk: Highly critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass, Arbitrary PHP code execution

Description

Context allows you to manage contextual conditions and reactions for different portions of your site

This advisory covers two separate issues.

Arbitrary PHP Code Execution

The first, and more severe issue (Highly Critical status), is that the module allows execution of PHP code via manipulation of a URL argument in a path used for AJAX operations when running in a configuration without a json_decode function provided by PHP or the PECL JSON library.

This vulnerability is mitigated by the fact that the server must be running a version of PHP prior to 5.2 that does not have the json library installed (PHP 5.2+ come bundled with the JSON library).

Access Bypass

The second, less severe issue (Less Critical status), is that Context uses Drupal's token scheme to restrict access to the json rendering of a block. This control mechanism is insufficient as Drupal's token scheme is designed to provide security between two different sessions (or a session and a non authenticated user) and is not designed to provide security within a session. This means that a user with access to block A may be able to use the information about block A and the resulting token in order to generate the correct token for accessing block B to which they should not have access.

The vulnerability is mitigated by needing blocks that have sensitive information (for example, custom blocks with private information or a list of unpublished nodes.)

CVE identifier(s) issued

  • CVE-2013-4445 (Access Bypass vulnerability)
  • CVE-2013-4446 (Arbitrary PHP Code Execution vulnerability)

Versions affected

  • 6.x-2.x versions prior to 6.x-3.2.
  • 7.x-3.x versions prior to 7.x-3.0.

Drupal core is not affected. If you do not use the contributed Context module, there is nothing you need to do.

Solution

Remote code execution can be resolved by any of

Block access issue can be resolved by upgrading context to 6.x-3.2 or 7.x-3.0.

Also see the Context project page.

Reported by

  • Heine of the Drupal Security Team

Fixed by

  • Hunter of the Drupal Security Team, a module maintainer
  • Heine of the Drupal Security Team
  • tekante a module maintainer

Coordinated by

  • Hunter of the Drupal Security Team

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

⋅ Categories: Drupal 6.x, Drupal 7.x