Bug 1204753 (CVE-2015-2749) - CVE-2015-2749 drupal: several flaws in "destination" query string redirecting
Summary: CVE-2015-2749 drupal: several flaws in "destination" query string redirecting
Status: CLOSED CURRENTRELEASE
Alias: CVE-2015-2749
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20150318,repo...
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-03-23 13:05 UTC by Martin Prpič
Modified: 2019-06-08 20:30 UTC (History)
6 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2015-03-23 13:06:07 UTC


Attachments (Terms of Use)

Description Martin Prpič 2015-03-23 13:05:43 UTC
The following flaw was found in Drupal:

Drupal core and contributed modules frequently use a "destination" query string parameter in URLs to redirect users to a new destination after completing an action on the current page. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.

In addition, several URL-related API functions in Drupal 6 and 7 can be tricked into passing through external URLs when not intending to, potentially leading to additional open redirect vulnerabilities.

This vulnerability is mitigated by the fact that many common uses of the "destination" parameter are not susceptible to the attack. However, all confirmation forms built using Drupal 7's form API are vulnerable via the Cancel action that appears at the bottom of the form, and some Drupal 6 confirmation forms are vulnerable too.

Upstream advisory:

https://www.drupal.org/SA-CORE-2015-001
https://www.drupal.org/node/2455007

Upstream patch:

http://cgit.drupalcode.org/drupal/commit/?id=d2304f840c43c190c6e136ee9901ed9797b4c3ca

CVE request pending:

http://seclists.org/oss-sec/2015/q1/893

Comment 1 Martin Prpič 2015-03-23 13:06:07 UTC
This flaw was fixed via:

FEDORA-EPEL-2015-1319  [98]drupal7-7.35-1.el6
FEDORA-EPEL-2015-1335  [101]drupal7-7.35-1.el7
FEDORA-2015-4315       [104]drupal7-7.35-1.fc20
FEDORA-2015-4340       [107]drupal7-7.35-1.fc21
FEDORA-2015-4244       [110]drupal7-7.35-1.fc22

FEDORA-EPEL-2015-1344  [98]drupal6-6.35-1.el5
FEDORA-EPEL-2015-1346  [101]drupal6-6.35-1.el6
FEDORA-2015-4394       [104]drupal6-6.35-1.fc20
FEDORA-2015-4372       [107]drupal6-6.35-1.fc21
FEDORA-2015-4366       [110]drupal6-6.35-1.fc22

Comment 2 Fabio Olive Leite 2015-03-27 19:05:43 UTC
CVE assigned: http://seclists.org/oss-sec/2015/q1/1014

Comment 3 Fabio Olive Leite 2015-03-27 19:46:17 UTC
The same Fedora updates should address CVE-2015-2750, assigned in the same oss-sec message above.


Note You need to log in before you can comment on or make changes to this bug.