Advisories

CERT-In Advisory CIAD-2013-0088

Multiple Vulnerabilities in Drupal

Original Issue Date: December 10, 2013

Severity Rating: High

Systems Affected

Drupal 6.x prior to 6.29
Drupal 7.x prior to 7.24

Overview

Multiple vulnerabilities have been reported in Drupal which could be exploited by remote attacker to conduct Cross Site Request Forgery (CSRF) attacks, Cross-Site Scripting (XSS) attacks, bypass certain security restrictions, conduct brute force attacks and execute arbitrary code.

Description

1. Cross Site Request Forgery (CSRF) vulnerability

This vulnerability caused due to unsafe operations executed by form validation functions in Drupal's form API. A remote attacker could exploit this vulnerability via a specially crafted link to redirect a user to an arbitrary website. Successful exploitation of this vulnerability could allow a remote attacker to conduct Cross Site Request Forgery (CSRF) attacks.

2. Multiple vulnerabilities in pseudorandom number generation

This vulnerability is caused due to usage of predictable seeds in PHP mt_rand function to generate random numbers in Drupal core. A remote attacker could exploit this vulnerability via brute force attacks to predict security strings. Successful exploitation of this vulnerability could allow a remote attacker to bypass certain intended restrictions.

3. Multiple Cross-Site Scripting (XSS) Vulnerabilities

These vulnerabilities are caused due to improper sanitization of certain unspecified input in Image and color module before being returned to the user in Drupal Core. A remote attacker could exploit these vulnerabilities to insert arbitrary HTML and script code.

Successful exploitation of these vulnerabilities could allow a remote attacker to conduct Cross-Site Scripting (XSS) attacks in context of an affected site.

Solution

Apply appropriate fixes or upgrade to latest version
https://drupal.org/download

Vendor Information

Drupal
https://drupal.org/
https://drupal.org/SA-CORE-2013-003

References

Drupal
https://drupal.org/SA-CORE-2013-003

Secunia
http://secunia.com/advisories/55713/

Security Focus
http://www.securityfocus.com/bid/63840
http://www.securityfocus.com/bid/63848
http://www.securityfocus.com/bid/63847
http://www.securityfocus.com/bid/63843

CVE Name
CVE-2013-6386
CVE-2013-6387
CVE-2013-6388
CVE-2013-6389

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India