Description
The Mass Contact module allows privileged users to send bulk email messages to groups of site users, optionally saving a copy of the message as a node along with any attached files.
The module's attachment processing routine passed an empty validators array when saving uploaded files, bypassing Drupal's built-in file extension and file size checks entirely. As a result, a user with the "Send messages with Mass Contact" permission could upload any file type (including server-executable scripts) and files of arbitrary size to the public files directory.
This vulnerability is mitigated by the fact that exploitation requires the "mass contact send messages" permission (not granted to anonymous or ordinary authenticated users by default), and that the attachment is only saved to disk when the sender explicitly opts to save a copy of the message as a node.
Solution
Install the latest version.
If you use the PROJECT_NAME module for Drupal 7, upgrade to mass_contact 7.x-1.3:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES