Description
The Field Validation integration submodule of Clientside Validation lets a rule configured with the Field Validation module be checked over an AJAX request while a form is being filled in.
The callback that runs the rule is reachable by any visitor, carries no token, and takes both the rule name and the value from the request, so it runs whatever rule the caller names against whatever value the caller supplies rather than being limited to the rule and field the form actually offered. A rule that reports whether a value is already in use therefore becomes an oracle that an anonymous caller can query for any value, and any rule on the site can be exercised outside the context it was meant for.
This vulnerability is mitigated by the requirement that the site have the Field Validation integration submodule enabled and at least one Field Validation rule configured.
Solution
Install the latest version.
If you use the Clientside Validation module for Drupal 7, upgrade to Clientside Validation 7.x-1.51:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES