Vulnerabilities > CVE-2016-9452 - Improper Input Validation vulnerability in Drupal

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the FreeBSD VuXML database :
#
# Copyright 2003-2018 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#    copyright notice, this list of conditions and the following
#    disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#    published online in any format, converted to PDF, PostScript,
#    RTF and other formats) must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
# 
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

include("compat.inc");

if (description)
{
  script_id(95365);
  script_version("3.8");
  script_cvs_date("Date: 2018/11/10 11:49:45");

  script_cve_id("CVE-2016-9449", "CVE-2016-9450", "CVE-2016-9451", "CVE-2016-9452");

  script_name(english:"FreeBSD : Drupal Code -- Multiple Vulnerabilities (8db24888-b2f5-11e6-8153-00248c0c745d)");
  script_summary(english:"Checks for updated packages in pkg_info output");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote FreeBSD host is missing one or more security-related
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The Drupal development team reports : Inconsistent name for term
access query (Less critical - Drupal 7 and Drupal 8) Drupal provides a
mechanism to alter database SELECT queries before they are executed.
Contributed and custom modules may use this mechanism to restrict
access to certain entities by implementing hook_query_alter() or
hook_query_TAG_alter() in order to add additional conditions. Queries
can be distinguished by means of query tags. As the documentation on
EntityFieldQuery::addTag() suggests, access-tags on entity queries
normally follow the form ENTITY_TYPE_access (e.g. node_access).
However, the taxonomy module's access query tag predated this system
and used term_access as the query tag instead of taxonomy_term_access.

As a result, before this security release modules wishing to restrict
access to taxonomy terms may have implemented an unsupported tag, or
needed to look for both tags (term_access and taxonomy_term_access) in
order to be compatible with queries generated both by Drupal core as
well as those generated by contributed modules like Entity Reference.
Otherwise information on taxonomy terms might have been disclosed to
unprivileged users.

Incorrect cache context on password reset page (Less critical - Drupal
8) The user password reset form does not specify a proper cache
context, which can lead to cache poisoning and unwanted content on the
page. Confirmation forms allow external URLs to be injected
(Moderately critical - Drupal 7) Under certain circumstances,
malicious users could construct a URL to a confirmation form that
would trick users into being redirected to a 3rd party website after
interacting with the form, thereby exposing the users to potential
social engineering attacks. Denial of service via transliterate
mechanism (Moderately critical - Drupal 8) A specially crafted URL can
cause a denial of service via the transliterate mechanism."
  );
  # https://vuxml.freebsd.org/freebsd/8db24888-b2f5-11e6-8153-00248c0c745d.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?92d3fe4a"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:drupal7");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:drupal8");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/11/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/11/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/28");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"FreeBSD Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");

  exit(0);
}


include("audit.inc");
include("freebsd_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (pkg_test(save_report:TRUE, pkg:"drupal7>=7.0<7.52")) flag++;
if (pkg_test(save_report:TRUE, pkg:"drupal8>=8.0.0<8.2.3")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(95026);
  script_version("1.10");
  script_cvs_date("Date: 2019/11/14");

  script_cve_id(
    "CVE-2016-9449",
    "CVE-2016-9450",
    "CVE-2016-9451",
    "CVE-2016-9452"
  );
  script_bugtraq_id(94367);

  script_name(english:"Drupal 7.x < 7.52 / 8.x < 8.2.3 Multiple Vulnerabilities");
  script_summary(english:"Checks the version of Drupal.");

  script_set_attribute(attribute:"synopsis", value:
"A PHP application running on the remote web server is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Drupal running on the remote web server is 7.x prior to
7.52 or 8.x prior to 8.2.3. It is, therefore, affected by the multiple
vulnerabilities :

  - An information disclosure vulnerability exists in the
    taxonomy module when using access query tags that are
    inconsistent with the standard system used by Drupal
    Core. An unauthenticated, remote attacker can exploit
    this to disclose sensitive information regarding
    taxonomy terms. (CVE-2016-9449)

  - A flaw exists in the password reset form due to a
    failure to properly specify a cache context. An
    unauthenticated, remote attacker can exploit this to
    poison the cache, by adding, for example, unwanted
    content to the page. Note that this issue only
    affects version 8.x. (CVE-2016-9450)

  - A cross-site redirection vulnerability exists in the
    confirmation form due to improper validation of input
    before returning it to users. An unauthenticated, remote
    attacker can exploit this, via a specially crafted link,
    to redirect the user to a website of the attacker's
    choosing. Note that this issue only affects version
    7.x. (CVE-2016-9451)

  - A denial of service vulnerability exists in the
    transliterate mechanism when handling specially crafted
    URLs. An unauthenticated, remote attacker can exploit
    this to cause a crash. Note that this issue only affects
    version 8.x. (CVE-2016-9452)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/SA-CORE-2016-005");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/7.52");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/8.2.3");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Drupal version 7.52 / 8.2.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-9450");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/11/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/11/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/21");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:drupal:drupal");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("drupal_detect.nasl");
  script_require_keys("www/PHP", "installed_sw/Drupal", "Settings/ParanoidReport");
  script_require_ports("Services/www", 80, 443);

  exit(0);
}

include("vcf.inc");
include("http.inc");

app = "Drupal";
get_install_count(app_name:app, exit_if_zero:TRUE);

if (report_paranoia < 2) audit(AUDIT_PARANOID);

port = get_http_port(default:80, php:TRUE);

app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

vcf::check_granularity(app_info:app_info, sig_segments:2);

constraints = [
  {"min_version" : "7.0", "fixed_version" : "7.52"},
  {"min_version" : "8.0", "fixed_version" : "8.2.3"}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);