Description
The Adaptive Image module provides responsive image delivery by serving differently-sized image style derivatives based on the visitor's detected screen resolution.
The module's image style delivery function called the effect settings helper — which iterates over the style's effects array — before validating that the image style argument is a valid array. When Drupal's image style loader returns a falsy value for a non-existent style name, this produces a PHP warning that includes the full server filesystem path to the module file. Additionally, the original guard invoked Drupal's exit function without first calling the not-found handler, causing the server to return HTTP 200 for invalid image style or scheme requests rather than a proper 404.
This vulnerability is mitigated by the fact that PHP error display must be enabled on the site (via the site's error level configuration or the PHP display_errors directive) for the filesystem path to be visible to a remote attacker; on hardened production sites with errors suppressed, only the incorrect 200 response is observable.
Solution
Install the latest version.
If you use the Adaptive Image module for Drupal 7, upgrade to adaptive_image 7.x-1.5:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES