Tag1 D7ES Security Advisories

The module's image delivery callback is a copy of a Drupal core function that checks access only when the requested file is in the private file system, and the copy also omits the derivative token validation that the original performs. An unauthenticated visitor can request a derivative of an image in the temporary file system, or in any stream wrapper provided by another module, and the module generates and returns it without consulting any access check and without requiring a token.

The Image module does not check access to image style derivatives when the derivative is stored on a file scheme other than the core private scheme, so an anonymous visitor who obtains a valid derivative URL can download derivatives of images that a contributed stream wrapper is meant to keep protected.

The Image Editor module builds the destination path for a fetched image out of client supplied filename and extension values without sanitizing them, allowing an authenticated user to write the fetched content to an arbitrary location with an arbitrary extension, including an executable PHP file inside the public files area, which can lead to remote code execution.

The Bad Behavior module prints logged request data such as the client IP, user agent, request URI, and request headers into its administration report pages without sanitization. Because those values originate from the raw HTTP request of an unauthenticated visitor, a request that Bad Behavior blocks and logs could store markup that runs in the browser of an administrator who later reviews the log.

The REST API file upload endpoints validate files by extension only, so an authenticated user can store a non-image file (such as HTML containing JavaScript) with an image extension and later reference it from an image field, leading to stored cross site scripting.

The Deploy remote Cache clear submodule registers a Services resource whose access callback unconditionally grants access, allowing any unauthenticated remote user to trigger a full cache flush on the server. Repeatedly invoking this operation can degrade performance and cause a denial of service.

The Snipshot and FotoFlexer editor save callbacks in the Image Editor module place an image value taken from the request query string into an inline JavaScript string without encoding it, allowing an attacker to run arbitrary JavaScript in the browser of a victim who follows a crafted link.

The Image Editor module resolves a file location supplied by the user in a POST parameter and passes it to cURL as an upload field without confining it to the site files directory. On PHP versions before 5.6, where cURL's legacy file upload mechanism is active, this lets an authenticated user make the server read an arbitrary local file, such as settings.php, and transmit its contents to an external image service. On PHP 5.6 and later the legacy mechanism is disabled, so no file contents are disclosed and the practical impact is limited to a forced outbound request.

The Image Editor module doesn't protect two state-changing AJAX endpoints against cross-site request forgery, allowing an attacker to trick a logged-in user who holds the relevant permission into performing an unauthorized image upload or image file overwrite without their intent.

The Taxonomy File Tree module builds the cancel link on its folder deletion form by inserting the raw destination query parameter into an anchor tag, allowing an attacker to craft a URL that injects arbitrary HTML into the page (reflected cross site scripting) or that points the cancel link at an external site (open redirect) for any user who opens the crafted link.