Description
The Media Crop module lets an editor define a crop of an image and then serves the cropped rendition from its own delivery route, which is deliberately open to everyone so that the callback itself can decide what may be served.
The callback decides whether the file needs an access check by comparing its scheme against the single value private, so Drupal's temporary file system and every stream wrapper a contributed module registers skip the check entirely and fall through to unconditional derivative generation and delivery. In the same callback, the test that the requested path matches the path of the file recorded on the crop instance calls Drupal's access denied handler without returning from the function, and because that handler renders a page rather than terminating the request, execution continued into generation and transfer and appended the image data to the forbidden response. The consequence is that the requirement to know the exact stored path was not enforced at all, leaving only the guessing of a crop instance identifier, which is a small sequential number.
This vulnerability is mitigated by the requirement that the site hold the images being cropped in a scheme that is not publicly readable, which is not the default configuration, and by the module being installed on relatively few sites.
Solution
Install the latest version.
If you use the Media crop module for Drupal 7, upgrade to Media crop 7.x-1.5:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES