Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
By Drupal Security Team on
- Advisory ID: DRUPAL-SA-CONTRIB-2012-118
- Project: Secure Login (third-party module)
- Version: 7.x
- Date: 2012-July-25
- Security risk: Less critical
- Exploitable from: Remote
- Vulnerability: Open Redirect
Description
Secure Login module enables the user login and other forms to be submitted securely via HTTPS, thus preventing passwords and other private user data from being transmitted in clear text. In addition, Secure Login module by default redirects non-HTTPS GET requests for pages containing forms that it secures to the HTTPS site.
The module does not sufficiently validate that a requested path is internal to the site, allowing an attacker to disguise a malicious destination address as a GET query parameter passed to a non-HTTPS site URL.
This vulnerability is mitigated by the fact that the target site must render a form secured by Secure Login module on its 404 page, such as in a block. A default installation of Drupal 7 renders the user login block on the 404 page, and is thus vulnerable to the open redirect.
CVE: Requested
Versions affected
- Secure Login 7.x-1.x versions prior to 7.x-1.3.
Drupal core is not affected. If you do not use the contributed Secure Login module, there is nothing you need to do.
Solution
Install the latest version:
- If you use the Secure Login module for Drupal 7.x, upgrade to Secure Login 7.x-1.3.
Also see the Secure Login project page.
Reported by
Fixed by
- Mark Burdett, the module maintainer
Coordinated by
- Heine Deelstra of the Drupal Security Team
- Greg Knaddison of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
