- Advisory ID: DRUPAL-SA-CONTRIB-2017-047
- Project: DRD agent (third-party module)
- Version: 6.x, 7.x, 8.x
- Date: 2017-May-10
- Security risk: 19/25 ( Critical) AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:All
- Vulnerability: Cross Site Request Forgery, Open Redirect
Description
The Drupal Remote Dashboard (DRD) module enables you to manage and monitor any remote Drupal site and, this module, the DRD Agent is the remote module which responds to requests from authorised DRD sites.
The module doesn't sufficiently protect the URL used to configure itself from CSRF attacks, which could allow a malicious user to craft a special URL that would reconfigure the DRD Agent and redirect to any URL if visited by an admin user.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
- DRD Agent 7.x-3.x versions prior to 7.x-3.1.
- DRD Agent 8.x-3.x versions prior to 8.x-3.1.
Drupal core is not affected. If you do not use the contributed DRD agent module, there is nothing you need to do.
Solution
Install the latest version:
- If you use the DRD Agent module for Drupal 7.x, upgrade to DRD Agent 7.x-3.1
- If you use the DRD Agent module for Drupal 8.x, upgrade to DRD Agent 8.x-3.1
Also see the DRD agent project page.
Reported by
- David Snopek of the Drupal Security Team
Fixed by
- Jürgen Haas the module maintainer
Coordinated by
- David Snopek of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
