Description
The Favorites module lets users bookmark site paths; for anonymous users the favorites are persisted in a per-visitor browser cookie.
The module did not restrict deserialization or authenticate the cookie body: anonymous favorites are written using Drupal's user-cookie helper, which sets a raw cookie with no HMAC or signature, so the cookie value is fully attacker-controlled. On render, the module iterates the request cookies and passes each value to its cookie-parsing routine, which deserialized the value with no restriction on the classes that may be instantiated (a second deserialization sink processes the parsed favorite's stored query). Because the module grants the manage-own-favorites permission to anonymous users, an attacker could supply a crafted favorites cookie that is deserialized on the next favorites render, instantiating an arbitrary object.
Turning object injection into code execution requires an autoloadable POP gadget, and full anonymous reachability requires the site to allow anonymous users to manage favorites (otherwise an authenticated user with that permission is still affected). This is the Drupal 7 contrib equivalent of the core unsafe-deserialization fix SA-CORE-2019-003 / CVE-2019-6340.
Solution
Install the latest version.
If you use the Favorites module for Drupal 7, upgrade to Favorites 7.x-2.2:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES