Description
The Helper module provides utility APIs for working with Drupal, including an XML helper that converts XML data from strings, files, or remote addresses into SimpleXML objects.
The module did not disable external entity loading or network access before handing the XML to PHP's SimpleXML parser, so an attacker supplying a document type declaration that defines an external entity could read arbitrary local files readable by the web server or cause the server to issue requests to attacker chosen network addresses.
This vulnerability is mitigated by the fact that it requires a separate Drupal module to pass user controlled data to the XML helper, and typically requires authenticated access to reach such an endpoint.
Solution
Install the latest version.
If you use the Helper module for Drupal 7, upgrade to Helper 7.x-1.11:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES