Description
The Clientside Validation module can validate a CAPTCHA answer over an AJAX request so the visitor learns whether their answer is correct without submitting the whole form.
The callback is open to anonymous visitors and authorises the request with a signed token, but that token covers only the name of the validation function and the challenge token, so it is not bound to the particular CAPTCHA session identifier that the request asks to have looked up. An attacker who obtains a single valid token by loading any form of their own can reuse it to test answers against any session identifier, and because the callback applies no attempt limit and never marks the session as used, it becomes an oracle that confirms whether a guessed answer is correct as many times as the attacker wishes.
This vulnerability is mitigated by the requirement that the site have both this module and the CAPTCHA module enabled with the module's CAPTCHA validation option in use.
Solution
Install the latest version.
If you use the Clientside Validation module for Drupal 7, upgrade to Clientside Validation 7.x-1.51:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES