Vulnerabilities > CVE-2017-6377 - Incorrect Authorization vulnerability in Drupal
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
HIGH Availability impact
NONE Summary
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 12 |
Common Weakness Enumeration (CWE)
Nessus
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_2730C6680B1C11E78D526CF0497DB129.NASL description Drupal Security Team reports : CVE-2017-6377: Editor module incorrectly checks access to inline private files CVE-2017-6379: Some admin paths were not protected with a CSRF token CVE-2017-6381: Remote code execution last seen 2020-06-01 modified 2020-06-02 plugin id 97808 published 2017-03-20 reporter This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/97808 title FreeBSD : drupal8 -- multiple vulnerabilities (2730c668-0b1c-11e7-8d52-6cf0497db129) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from the FreeBSD VuXML database : # # Copyright 2003-2018 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include("compat.inc"); if (description) { script_id(97808); script_version("3.8"); script_cvs_date("Date: 2018/12/19 13:21:18"); script_cve_id("CVE-2017-6377", "CVE-2017-6379", "CVE-2017-6381"); script_name(english:"FreeBSD : drupal8 -- multiple vulnerabilities (2730c668-0b1c-11e7-8d52-6cf0497db129)"); script_summary(english:"Checks for updated package in pkg_info output"); script_set_attribute( attribute:"synopsis", value:"The remote FreeBSD host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Drupal Security Team reports : CVE-2017-6377: Editor module incorrectly checks access to inline private files CVE-2017-6379: Some admin paths were not protected with a CSRF token CVE-2017-6381: Remote code execution" ); # https://www.drupal.org/SA-2017-001 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?aba24102" ); # https://vuxml.freebsd.org/freebsd/2730c668-0b1c-11e7-8d52-6cf0497db129.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?06b93036" ); script_set_attribute(attribute:"solution", value:"Update the affected package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:drupal8"); script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/03/15"); script_set_attribute(attribute:"patch_publication_date", value:"2017/03/17"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/20"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"FreeBSD Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info"); exit(0); } include("audit.inc"); include("freebsd_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD"); if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (pkg_test(save_report:TRUE, pkg:"drupal8<8.2.7")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family CGI abuses NASL id DRUPAL_8_2_7.NASL description The version of Drupal running on the remote web server is 8.x prior to 8.2.7. It is, therefore, affected by the multiple vulnerabilities : - A security bypass vulnerability exists in the editor module due to a failure to properly check access restrictions when adding private files with a configured text editor (e.g. CKEDITOR). An unauthenticated, remote attacker can exploit this to bypass access restrictions and disclose arbitrary files. (CVE-2017-6377) - A cross-site request forgery (XSRF) vulnerability exists as HTTP requests do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to cause the user to disable some blocks on sites or perform additional unintended actions. (CVE-2017-6379) - An unspecified flaw exists in the PHPUnit component that allows an unauthenticated, remote attacker to execute arbitrary code. Note that this vulnerability may only impact versions prior to 8.2.2. (CVE-2017-6381) Note that Nessus has not tested for these issues but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 97942 published 2017-03-24 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/97942 title Drupal 8.x < 8.2.7 Multiple Vulnerabilities (SA-2017-001) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(97942); script_version("1.7"); script_cvs_date("Date: 2019/11/13"); script_cve_id("CVE-2017-6377", "CVE-2017-6379", "CVE-2017-6381"); script_bugtraq_id(96919); script_name(english:"Drupal 8.x < 8.2.7 Multiple Vulnerabilities (SA-2017-001)"); script_summary(english:"Checks the version of Drupal."); script_set_attribute(attribute:"synopsis", value: "A PHP application running on the remote web server is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Drupal running on the remote web server is 8.x prior to 8.2.7. It is, therefore, affected by the multiple vulnerabilities : - A security bypass vulnerability exists in the editor module due to a failure to properly check access restrictions when adding private files with a configured text editor (e.g. CKEDITOR). An unauthenticated, remote attacker can exploit this to bypass access restrictions and disclose arbitrary files. (CVE-2017-6377) - A cross-site request forgery (XSRF) vulnerability exists as HTTP requests do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to cause the user to disable some blocks on sites or perform additional unintended actions. (CVE-2017-6379) - An unspecified flaw exists in the PHPUnit component that allows an unauthenticated, remote attacker to execute arbitrary code. Note that this vulnerability may only impact versions prior to 8.2.2. (CVE-2017-6381) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/SA-2017-001"); script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/8.2.7"); script_set_attribute(attribute:"solution", value: "Upgrade to Drupal version 8.2.7 or later. Additionally, as a workaround for CVE-2017-6381, remove the /vendor/phpunit directory."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:ND"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:X"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/03/15"); script_set_attribute(attribute:"patch_publication_date", value:"2017/03/15"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/24"); script_set_attribute(attribute:"potential_vulnerability", value:"true"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:drupal:drupal"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"CGI abuses"); script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("drupal_detect.nasl"); script_require_keys("www/PHP", "installed_sw/Drupal", "Settings/ParanoidReport"); script_require_ports("Services/www", 80, 443); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("http.inc"); include("install_func.inc"); app = "Drupal"; get_install_count(app_name:app, exit_if_zero:TRUE); if (report_paranoia < 2) audit(AUDIT_PARANOID); port = get_http_port(default:80, php:TRUE); install = get_single_install( app_name : app, port : port, exit_if_unknown_ver : TRUE ); dir = install['path']; version = install['version']; url = build_url(qs:dir, port:port); fix = NULL; if (version == "8") audit(AUDIT_VER_NOT_GRANULAR, app, port, version); if (ver_compare(ver:version, minver:"8.0", fix:"8.2.7", strict:FALSE) < 0) fix = "8.2.7"; if (isnull(fix)) audit(AUDIT_WEB_APP_NOT_AFFECTED, app, url, version); security_report_v4( port:port, severity:SECURITY_WARNING, xsrf:TRUE, extra: '\n URL : ' + url + '\n Installed version : ' + version + '\n Fixed version : ' + fix + '\n' );