Description
The Salesforce Suite module provides OAuth 2.0-based integration between Drupal and the Salesforce REST API, mapping Salesforce objects to Drupal entities.
The module does not generate a cryptographically random state parameter when initiating the authorization request, and the OAuth callback accepts any authorization code without verifying that the response corresponds to a handshake the site itself started. An attacker can therefore complete the OAuth flow with an authorization code obtained from their own Salesforce remote application and bind the site to an account they control.
This vulnerability is mitigated by the fact that the attacker must obtain a valid Salesforce authorization code and induce the OAuth callback to be requested in the context of the site.
Solution
Install the latest version.
If you use the Salesforce Suite module for Drupal 7, upgrade to Salesforce Suite 7.x-3.4:
Reported by
Fixed by
Coordinated by
- Tag1 D7ES