Description
The Clientside Validation module offers a URL validation rule, and provides an AJAX callback that confirms whether a given value is a path the site can serve.
The callback is reachable by any visitor, carries no token, and passes the request supplied value into the menu resolver, which executes the path's load functions and access callback before returning whether the path is valid. This turns the callback into an oracle that reports whether an arbitrary path exists and is reachable, and it performs the associated router work for whatever value an anonymous caller sends, with no confirmation that the request originated from a form the site served.
This vulnerability is mitigated by the fact that the answer it returns largely duplicates what an anonymous visitor could already learn by requesting the path directly, so the added disclosure is limited and the change is primarily hardening.
Solution
Install the latest version.
If you use the Clientside Validation module for Drupal 7, upgrade to Clientside Validation 7.x-1.51:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES