Tag1 D7ES Security Advisories

The module ships a shared miniOrange customer identifier and API key inside its source code and falls back to that pair to sign requests to the miniOrange service whenever a site has not configured its own credentials, so anyone who downloads the module can extract the secret and mint validly signed requests to the vendor API under a customer identity shared across many other installations.

The RESTful file-upload data provider validates uploaded files by extension only, so a non-image file containing an HTML/JavaScript payload but bearing an image extension can be stored against an image-bound file resource and later served as text/html from the public files directory, leading to stored XSS.

The module's cropped image delivery callback checks access only when the file is in the private file system, so a cropped rendition of an image held in any other scheme that is not publicly readable is generated and served without any access check. A second fault in the same callback renders the access denied page without stopping execution, so the check that the requested path matches the stored file was never actually enforced.

The module provides an anonymous AJAX callback that checks a CAPTCHA answer, but the signed token it trusts is tied only to the challenge type and not to the CAPTCHA session being answered, and the callback neither limits the number of attempts nor invalidates the session on a wrong answer. An attacker holding one valid token from any of their own forms can therefore verify answers against another visitor's CAPTCHA session and can try an unlimited number of guesses, which defeats the CAPTCHA protection entirely.

The module exposes an AJAX callback, open to anonymous visitors and protected by no token, that resolves an arbitrary path taken from the request through the menu router to decide whether it is valid. Resolving the path runs its load functions and access callback, so the callback both answers whether a path exists and is reachable by the requester and performs that work on unbounded anonymous input.

The module registers an AJAX validation callback that is open to anonymous visitors and passes a regular expression taken directly from the request into the PCRE engine, so an attacker can have the server evaluate a pattern of their choosing against a value of their choosing. A crafted pattern that backtracks heavily consumes server processing time on every request, and because the callback requires no token and imposes no limit it can be called repeatedly.

The Database search module built the SQL condition for the "NOT BETWEEN" range operator by embedding both range bounds directly into the query string instead of passing them as placeholders. On a site that exposes a range filter to untrusted users, an attacker could inject arbitrary SQL through either range bound and read the contents of the database.

The Field Validation integration submodule provides an AJAX callback, open to anonymous visitors and protected by no token, that runs a field validation rule named in the request against a value taken from the request. An attacker can therefore run any validation rule configured anywhere on the site against a value of their choosing, which turns rules such as uniqueness checks into oracles that confirm whether a given value already exists.

The module's image delivery callback is a copy of a Drupal core function that checks access only when the requested file is in the private file system, and the copy also omits the derivative token validation that the original performs. An unauthenticated visitor can request a derivative of an image in the temporary file system, or in any stream wrapper provided by another module, and the module generates and returns it without consulting any access check and without requiring a token.

The module grants access to any file that is not in the private file system by returning download headers for it, without asking any other module whether the current user is allowed to read that file. An unauthenticated visitor who appends the module's download parameter to a file URL receives files from the temporary file system or from any stream wrapper supplied by another module, overriding the access checks those modules would otherwise apply.