Node View Permissions - Moderately Critical - Access Bypass

Description

The Node View Permissions module provides granular "view own content" and "view any content" permissions per content type, supplementing Drupal core's access control.

The module did not exclude anonymous users (uid=0) from the uid-equality check used to grant "view own" access, allowing $account->uid == $node->uid to evaluate as true whenever a node's authorship was set to uid=0 (as happens when a user account is cancelled and content is reassigned rather than deleted).

This vulnerability is mitigated by the fact that it requires the site to have explicitly granted "view own [type] content" to the anonymous role — an atypical configuration — and that nodes must have been reassigned to uid=0 through account cancellation rather than normal content authorship.

Solution

Install the latest version.

If you use the Node View Permissions module for Drupal 7, upgrade to node_view_permissions 7.x-1.7:

• node_view_permissions-7.x-1.7.tar.gz
• node_view_permissions-7.x-1.7.zip

Reported by

• Ra Mänd (ram4nd)

Fixed by

• Tag1 D7ES

Coordinated by

• Tag1 D7ES