Drupal 8.7.4 Workspaces input validation

Summaryinfo

A vulnerability classified as critical has been found in Drupal 8.7.4. Affected by this vulnerability is an unknown functionality of the component Workspaces Module. The manipulation leads to input validation. This vulnerability is uniquely identified as CVE-2019-6342. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Drupal 8.7.4 (Content Management System). It has been rated as critical. This issue affects some unknown processing of the component Workspaces Module. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.

The weakness was disclosed 07/17/2019 by Dave Botsch as SA-CORE-2019-008 as confirmed security advisory (Website). It is possible to read the advisory at drupal.org. The identification of this vulnerability is CVE-2019-6342 since 01/15/2019. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The advisory points out:

In Drupal 8.7.4, when the experimental Workspaces module is enabled, an access bypass condition is created.

Upgrading to version 8.7.5 eliminates this vulnerability. The upgrade is hosted for download at drupal.org. A possible mitigation has been published immediately after the disclosure of the vulnerability. The security advisory contains the following remark:

This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4. Drupal 8.7.3 and earlier, Drupal 8.6.x and earlier, and Drupal 7.x are not affected. Note, manual step needed. For sites with the Workspaces module enabled, update.php needs to run to ensure a required cache clear. If there is a reverse proxy cache or content delivery network (e.g. Varnish, CloudFlare) it is also advisable to clear these as well.

bleepingcomputer.com is providing further details. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Not Affected

• Drupal up to 8.7.3

Productinfo

Type

• Content Management System

Name

• Drupal

Version

• 8.7.4

License

• open-source

Website

• Product: https://www.drupal.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion