Tag1 D7ES Security Advisories

The module does not sufficiently force certain uploaded file types to download when served. Under certain site configurations, a file uploaded through a webform could be rendered inline by a browser, resulting in a cross-site scripting vulnerability.

The module ships a shared miniOrange customer identifier and API key inside its source code and falls back to that pair to sign requests to the miniOrange service whenever a site has not configured its own credentials, so anyone who downloads the module can extract the secret and mint validly signed requests to the vendor API under a customer identity shared across many other installations.

The miniorange_saml module weakens SecKit's cross origin CSRF protection site wide by adding origins to SecKit's origin whitelist on every request instead of only on its SAML assertion consumer service endpoint. On a site that also runs SecKit with origin based CSRF protection enabled, this lets a cross origin POST bearing a whitelisted origin pass SecKit's origin check on any path.

The Block Title Link module replaces the tokens in a block title link against the user who is viewing the page rather than a fixed context, so a user who can configure a block title link can embed a personal token such as the email address or the one time login URL and have each visitor's own value written into an attacker chosen link, disclosing it when the visitor follows the link.

The module renders the contents of imported CSV tables through an aggregate report block with no access control, allowing any visitor, including anonymous users, to read the imported data once the block is placed.

An earlier release of the module saved the miniOrange account password of the administrator who registered the module as a cleartext site variable, and later releases stopped writing it but never removed the stored copy, so the password persists in the database and in every backup on upgraded sites.

The SAML SSO Service Provider module fetched the identity provider metadata document over HTTPS with TLS peer and hostname verification disabled, then stored the signing certificate, issuer and login URL it received as trusted configuration and switched SAML login on. A network attacker able to intercept that fetch could hand the site a forged metadata document and thereby control the certificate used to validate every later SAML response, allowing authentication to be forged for any account including administrators.

The module echoes several values taken directly from an incoming SAML response into HTML error pages at its anonymous assertion consumer endpoint without sanitizing them. An unauthenticated attacker can submit a crafted response and have arbitrary markup and script reflected into a victim's browser, and because the vulnerable output runs before any signature is verified the response does not need to be signed or come from a trusted identity provider.

The module ships fixed RSA private keys inside its resources directory, and because these files are identical in every install and downloadable by any anonymous visitor over HTTP, an attacker can retrieve the Service Provider private key and use it to decrypt encrypted SAML assertions.

The Block Title Link module passes the stored block title link through the PHP evaluation function on every block render when the core PHP filter module is enabled, so any user who can configure a block title link can execute arbitrary PHP code on the server.