Project
Helper
Date
Severity
Moderately Critical
Risk Score
10/25 AC:Basic/A:User/CI:Some/II:None/E:Proof/TD:Uncommon
Vulnerability
The Helper module's XML parsing API accepted user-controlled URLs without validating whether the target address was an internal or reserved network resource, allowing authenticated attackers to make the server issue requests to private infrastructure.
Affected versions
<7.x-1.10

Description

The Helper module provides a suite of utility APIs for Drupal, including `XmlHelper` for loading and parsing XML from strings, files, or remote URLs.

The `XmlHelper::normalizeDataToSimpleXml()` method passed any absolute URL directly to PHP's `simplexml_load_file()` without restricting the target host. An attacker who could supply a URL to this function could direct the server to fetch resources from internal addresses such as `http://127.0.0.1/`, RFC 1918 private ranges, or cloud metadata endpoints like `http://169.254.169.254/latest/meta-data/`, as well as use non-HTTP schemes (e.g., `file://`, `ftp://`) supported by PHP stream wrappers.

This vulnerability is mitigated by the fact that exploitability depends on another module or custom code passing attacker-controlled input to the `XmlHelper` API, and that the site must be hosted in an environment with accessible internal services.

Solution

Install the latest version.

If you use the Helper module for Drupal 7, upgrade to helper 7.x-1.10:

Reported by

Fixed by

  • Tag1 D7ES

Coordinated by

  • Tag1 D7ES