View online: https://drupal.org/node/2113317 * Advisory ID: DRUPAL-SA-CONTRIB-2013-079 * Project: Context [1] (third-party module) * Version: 6.x, 7.x * Date: 2013-2013-16 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Access bypass, Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- Context allows you to manage contextual conditions and reactions for different portions of your site This advisory covers two separate issues. The first, and more severe issue (Highly Critical status), is that the module allows execution of PHP code via manipulation of a URL argument in a path used for AJAX operations when running in a configuration without a json_decode function provided by PHP or the PECL JSON library. This vulnerability is mitigated by the fact that the server must be running a version of PHP prior to 5.2 that does not have the json library installed (PHP 5.2+ come bundled with the JSON library). The second, less severe issue (Less Critical status), is that Context uses Drupal's token scheme to restrict access to the json rendering of a block. This control mechanism is insufficient as Drupal's token scheme is designed to provide security between two different sessions (or a session and a non authenticated user) and is not designed to provide security within a session. This means that a user with access to block A may be able to use the information about block A and the resulting token in order to generate the correct token for accessing block B to which they should not have access. The vulnerability is mitigated by needing blocks that have sensitive information (for example, custom blocks with private information or a list of unpublished nodes.) -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * 6.x-2.x versions prior to 6.x-3.2. * 7.x-3.x versions prior to 7.x-3.0. Drupal core is not affected. If you do not use the contributed Context [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Remote code execution can be resolved by any of * Upgrading your PHP to 5.2+ * Installing the JSON package [5]. * Upgrading context to 6.x-3.2 [6] or 7.x-3.0 [7] Block access issue can be resolved by upgrading context to 6.x-3.2 [8] or 7.x-3.0 [9]. Also see the Context [10] project page. -------- REPORTED BY --------------------------------------------------------- * Heine [11] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Hunter [12] of the Drupal Security Team, a module maintainer * Heine [13] of the Drupal Security Team * tekante [14] a module maintainer -------- COORDINATED BY ------------------------------------------------------ * Hunter [15] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [16]. Learn more about the Drupal Security team and their policies [17], writing secure code for Drupal [18], and securing your site [19]. [1] http://drupal.org/project/context [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/context [5] http://pecl.php.net/package/json [6] https://drupal.org/node/2112791 [7] https://drupal.org/node/2112785 [8] https://drupal.org/node/2112791 [9] https://drupal.org/node/2112785 [10] http://drupal.org/project/context [11] http://drupal.org/user/17943 [12] http://drupal.org/user/426416 [13] http://drupal.org/user/17943 [14] http://drupal.org/user/640024 [15] http://drupal.org/user/426416 [16] http://drupal.org/contact [17] http://drupal.org/security-team [18] http://drupal.org/writing-secure-code [19] http://drupal.org/security/secure-configuration