Voting starts in March for the Drupal Association Board election.
- Advisory ID: DRUPAL-SA-CONTRIB-2013-095
- Project: Organic groups (third-party module)
- Version: 7.x
- Date: 2013-November-20
- Security risk: Moderately critical
- Exploitable from: Remote
- Vulnerability: Access bypass
Two issues exist within entity references and permissions relating to OG, allowing users potential access bypass.
Posting content into groups where a user is not a member
Organic Groups does not sufficiently check the group audience fields (e.g. og_group_ref) field from being populated with invalid data. The autocomplete reference field only needs a node id to validate.
An attacker could modify a group audience field in order to post within a group they had no access.
Any user with the ability to create content can use this vulnerability.
Inconsistent access checking in posting content
Organic Groups manages its own group based permissions. This allows users to have escalated privileges sets in specific groups, but not site-wide. Organic Groups makes the assumption that the group field is populated and when this not populated, a user may have permission to create or edit content outside of a group even though they shouldn't be allowed to do that.
This vulnerability is mitigated because the following must be true in order for it to work:
1) The node in question must have all of its groups be set as optional input
2) The user must not have site-wide access to post content of a certain type, but also a member of a group that does permit create/edit privileges to the same type.
CVE identifier(s) issued
- Posting content into groups where a user is not a member: CVE-2013-7065
- Inconsistent access checking in posting content: CVE-2013-7068
- OG 7.x-2.x versions prior to 7.x-2.3
Drupal core is not affected. If you do not use the contributed Organic groups module, there is nothing you need to do.
Install the latest version:
- If you use the Organic Groups module for Drupal 7.x, upgrade to og 7.x-2.4
Also see the Organic groups project page.
- David Stoline of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.