Drupal Association members fund grants that make connections all over the world.
- Advisory ID: DRUPAL-SA-CONTRIB-2012-118
- Project: Secure Login (third-party module)
- Version: 7.x
- Date: 2012-July-25
- Security risk: Less critical
- Exploitable from: Remote
- Vulnerability: Open Redirect
Secure Login module enables the user login and other forms to be submitted securely via HTTPS, thus preventing passwords and other private user data from being transmitted in clear text. In addition, Secure Login module by default redirects non-HTTPS GET requests for pages containing forms that it secures to the HTTPS site.
The module does not sufficiently validate that a requested path is internal to the site, allowing an attacker to disguise a malicious destination address as a GET query parameter passed to a non-HTTPS site URL.
This vulnerability is mitigated by the fact that the target site must render a form secured by Secure Login module on its 404 page, such as in a block. A default installation of Drupal 7 renders the user login block on the 404 page, and is thus vulnerable to the open redirect.
- Secure Login 7.x-1.x versions prior to 7.x-1.3.
Drupal core is not affected. If you do not use the contributed Secure Login module, there is nothing you need to do.
Install the latest version:
- If you use the Secure Login module for Drupal 7.x, upgrade to Secure Login 7.x-1.3.
Also see the Secure Login project page.
- Mark Burdett, the module maintainer
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.