Description
The Responsive Panel Panes module renders Panels panes for different media queries by fetching pane content over AJAX from the responsive panels get panes endpoint.
The module does not authenticate or validate that endpoint. The module’s menu definition registers the get panes path with an access callback that allows everyone, including anonymous users. The page callback iterates over the posted panes array and base64 decodes then unserializes each attacker controlled context value. Base64 decoding is only an encoding step and does not provide security. There is no permission check, CSRF token, or validation of the data structure, and the request’s GET parameters are rebuilt from the posted input.
An unauthenticated attacker can therefore POST a base64 encoded serialized object to instantiate an arbitrary class and trigger magic methods. With an autoloadable POP gadget chain this can lead to remote code execution. This is the Drupal 7 contrib equivalent of the core unsafe deserialization fix SA CORE 2019 003 CVE 2019 6340.
Solution
Install the latest version.
If you use the Responsive Panel Panes module for Drupal 7, upgrade to Responsive Panel Panes 7.x-1.4:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES