The following flaw was reported to the Full Disclosure mailing list:
Description of Vulnerability:
The Flag 7.x-3.5 module contains an improper input handling (IH)
vulnerability created by it's failure to validate user
supplied PHP code, input via it's "flag importer" form, before using
PHP's "eval" function to execute the code on the server.
Using the flag importer form, a malicious user is able to execute
arbitrary code with the permissions of the server on the host machine.
Drupal 7.26 with Flag 7.x-3.0 and Flag 7.x-3.5 (current recommended
release) were tested and found to be vulnerable
Users with the permission to use the flag importer can inject and
execute arbitrary code on the host server with server permissions.
This vulnerability can be exploited to upload a malicious payload onto
the vulnerable server, mount a Denial of Service (DoS) attack
or effect other server-side attacks.
This vulnerability is mitigated by the fact that a user must have
permission to use the flag importer. The Flag module
deactivates this permission by default for users other than site
administrators, and cautions adminsitrators against granting
this permission to other roles.
The Drupal Security team was contacted on May 8, 2014 and responded
that because the permissions assignment page
carries the warning "Warning: Give to trusted roles only; this
permission has security implications." a coordinated
security fix and announcement is not warranted.
A patch is available from .
The patch applies to drupal6-flag-2.1-1.fc20 in Fedora 20, but I have not tested whether it is really affected or not.
drupal6-flag-1.3-3.fc19 in Fedora 19 does not appear to be affected (no affected file, missing the affected functions, etc)
Created drupal6-flag tracking bugs for this issue:
Affects: fedora-20 [bug 1096607]
MITRE assigned CVE-2014-3453 to this issue:
drupal6-flag-2.1-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
drupal6-flag-2.1-3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
All dependent bugs have been closed. Can this bug be closed?