Bug 1096604 (CVE-2014-3453) - CVE-2014-3453 drupal6-flag: code execution flaw in flag importer
Summary: CVE-2014-3453 drupal6-flag: code execution flaw in flag importer
Alias: CVE-2014-3453
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1096607
TreeView+ depends on / blocked
Reported: 2014-05-12 06:41 UTC by Murray McAllister
Modified: 2019-09-29 13:17 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2015-02-12 17:46:13 UTC

Attachments (Terms of Use)

Description Murray McAllister 2014-05-12 06:41:41 UTC
The following flaw was reported to the Full Disclosure mailing list[1]:


Description of Vulnerability:
- -----------------------------
The Flag 7.x-3.5 module contains an improper input handling (IH)
vulnerability created by it's failure to validate user
supplied PHP code, input via it's "flag importer" form, before using
PHP's "eval" function to execute the code on the server.
Using the flag importer form, a malicious user is able to execute
arbitrary code with the permissions of the server on the host machine.

Systems Impacted:
- ----------------
Drupal 7.26 with Flag 7.x-3.0 and Flag 7.x-3.5 (current recommended
release) were tested and found to be vulnerable

- -------
Users with the permission to use the flag importer can inject and
execute arbitrary code on the host server with server permissions.
This vulnerability can be exploited to upload a malicious payload onto
the vulnerable server, mount a Denial of Service (DoS) attack
or effect other server-side attacks.

Mitigating Factors:
- -------------------
This vulnerability is mitigated by the fact that a user must have
permission to use the flag importer. The Flag module
deactivates this permission by default for users other than site
administrators, and cautions adminsitrators against granting
this permission to other roles.


Vendor Response:
- ---------------------
The Drupal Security team was contacted on May 8, 2014 and responded
that because the permissions assignment page
carries the warning "Warning: Give to trusted roles only; this
permission has security implications." a coordinated
security fix and announcement is not warranted.


[1] http://seclists.org/fulldisclosure/2014/May/44

A patch is available from [1].

The patch applies to drupal6-flag-2.1-1.fc20 in Fedora 20, but I have not tested whether it is really affected or not.

drupal6-flag-1.3-3.fc19 in Fedora 19 does not appear to be affected (no affected file, missing the affected functions, etc)

Comment 1 Murray McAllister 2014-05-12 06:43:14 UTC
Created drupal6-flag tracking bugs for this issue:

Affects: fedora-20 [bug 1096607]

Comment 3 Murray McAllister 2014-05-12 07:56:39 UTC
MITRE assigned CVE-2014-3453 to this issue:


Comment 5 Fedora Update System 2015-01-14 07:26:15 UTC
drupal6-flag-2.1-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-01-14 07:30:37 UTC
drupal6-flag-2.1-3.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Shawn Iwinski 2015-02-09 13:34:31 UTC
All dependent bugs have been closed.  Can this bug be closed?

Note You need to log in before you can comment on or make changes to this bug.