Description
The BOTCHA module protects Drupal forms from automated spam submissions by injecting hidden fields whose names and expected values are derived from a site-specific secret via MD5 hashing of the form build ID combined with that secret.
The module defined the secret as a variable lookup that fell back to a hardcoded, publicly-known default value whenever the secret had never been set. Since August 2013 the install hook generates a random, site-unique secret, so the hardcoded fallback is never reached on a normal install. However, sites installed before that date never had the variable written to the database and have used the publicly-visible hardcoded value ever since.
An attacker on such a site can retrieve the form build ID from any rendered form, compute the expected hidden field name and value using the known default secret, and submit a valid BOTCHA response, rendering the protection ineffective.
This vulnerability is further mitigated by the fact that an attacker must craft a custom HTTP client capable of computing the MD5-derived field names for each form submission; off-the-shelf spam bots without knowledge of the BOTCHA algorithm are unaffected.
Solution
Install the latest version.
If you use the BOTCHA Spam Prevention module for Drupal 7, upgrade to botcha 7.x-3.5:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES