Description
The Inspect Profile module (a submodule of the Inspect project) profiles the performance of individual procedures and of event sequences spanning multiple requests, and exposes the collected reports under the site's administration reports section.
The module's report download and report generation menu routes are configured with an access callback that unconditionally grants access, which takes precedence over and silently voids the permissions those routes were meant to require. As a result, access is granted to every user — including anonymous visitors — and the intended report-access and site-configuration permissions are never checked, letting an unauthenticated user download any stored profiling report as a CSV file (leaking the site name, server name and internal event/timing data) by requesting the download route with a report id.
This vulnerability is mitigated by the fact that Inspect Profile is a developer tool rarely enabled on production sites, that a report is only exposed when it already exists in the database, and that the heavy report-generation route remains protected by an in-function permission check even when its menu access is bypassed.
Solution
Install the latest version.
If you use the Inspect module for Drupal 7, upgrade to Inspect 7.x-6.8:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES