SA-CONTRIB-2013-095 - Organic Groups - Access bypass

By Drupal Security Team on 20 Nov 2013 at 18:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-095
Project: Organic groups (third-party module)
Version: 7.x
Date: 2013-November-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

Description

Two issues exist within entity references and permissions relating to OG, allowing users potential access bypass.

Posting content into groups where a user is not a member

Organic Groups does not sufficiently check the group audience fields (e.g. og_group_ref) field from being populated with invalid data. The autocomplete reference field only needs a node id to validate.

An attacker could modify a group audience field in order to post within a group they had no access.

Any user with the ability to create content can use this vulnerability.

Inconsistent access checking in posting content

Organic Groups manages its own group based permissions. This allows users to have escalated privileges sets in specific groups, but not site-wide. Organic Groups makes the assumption that the group field is populated and when this not populated, a user may have permission to create or edit content outside of a group even though they shouldn't be allowed to do that.

This vulnerability is mitigated because the following must be true in order for it to work:
1) The node in question must have all of its groups be set as optional input
2) The user must not have site-wide access to post content of a certain type, but also a member of a group that does permit create/edit privileges to the same type.