Jacob Rockowitz

تسمح ثغرة تفويض غير صحيح بالتصفح القسري (forceful browsing) في وحدة Webform. تفشل الوحدة في تقييد الوصول بشكل كافٍ إلى أوضاع عرض معينة للطلبات المقدمة. وبناءً على ذلك، يمكن للمستخدم الذي يملك صلاحية عرض طلب مقدم الوصول إلى وضع عرض أكثر تساهلاً ورؤية حقول من المفترض أن تكون مقيدة. يتطلب هذا أن يكون لدى المهاجم بالفعل صلاحية الوصول لعرض الطلب المتأثر.

The Webform module fails to sufficiently exclude certain format templates from token replacement. This allows an attacker to submit data that is evaluated as template code during the rendering of a submission. Depending on the site configuration and enabled modules, this can result in remote code execution, stored cross-site scripting (XSS), or information disclosure. This issue is mitigated if the webform is not configured with a custom multiple-value item format that includes submission-value tokens. Approximately 436,300 instances were identified globally.

An issue exists where user-specific access rules are not sufficiently guarded against malformed saved configurations. Under specific site conditions, an access rule designed to restrict submission access to selected user accounts may inadvertently grant access to anonymous users. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

The Webform module fails to properly force the download of certain uploaded file types when they are served. In specific site configurations, a file uploaded via a webform can be rendered inline by a browser, leading to cross-site scripting (XSS), where malicious scripts are executed in the victim's browser. Approximately 436,300 instances were identified globally. This issue requires a user with permissions to create or edit webforms to allow the affected file extensions, and a victim must manually open the uploaded file.

The Webform module contains a rating element that does not sufficiently validate data. This flaw could allow cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, on pages containing a rating element. Exploitation requires the attacker to be able to place crafted HTML markup on the same page as the rating element. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

The Webform module fails to sufficiently sanitize attributes used by its color element. This can lead to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, when the element is rendered. Exploitation requires the attacker to add a specially crafted link with a specific class to the same page as the affected webform. Approximately 436,400 instances of Drupal were identified globally as potential targets.

An issue exists in the Webform module, which is used to create forms and collect submissions. Due to improper sanitization of announcement text used for assistive technologies, specially crafted input can lead to cross-site scripting. Approximately 436,400 instances of Drupal were identified globally as potentially exposed. Remote code execution is also possible.

The Webform module fails to sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. This flaw allows markup from counter-related settings to be inserted into the page, resulting in cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. Exploitation requires the attacker to have permissions to create or edit affected Webform elements or to place crafted counter markup on a page where the Webform counter JavaScript is active. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

The Webform module, used for creating forms and processing submissions, contains a flaw in how it handles Remote Post handlers. These handlers send data to external servers via APIs. The module fails to sufficiently filter response values from the Remote Post handler before they are rendered through handler response tokens. Consequently, if a site uses these tokens in rendered output, a remote endpoint could return values that are rendered as HTML, leading to cross-site scripting (XSS), where malicious scripts are injected into trusted websites. Approximately 436,300 instances were identified globally.

The Webform Entity Print submodule does not sufficiently limit access to its print templates. A user with permissions to create and edit their own webforms can exploit this to perform cross-site scripting (XSS) within the submodule settings. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

The Webform Share submodule, which allows site builders to expose webforms for embedding on other sites, contains a flaw where submissions for Ajax-enabled webforms can bypass anti-spam protections. This occurs when the webform relies on compatible Form-API-based anti-spam protections, such as Honeypot or Antibot. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

The Webform module fails to sufficiently validate an optional token query value. In specific configurations where a form is rendered for anonymous visitors, a malicious request can cause excessive resource consumption, resulting in a Denial of Service. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they are not authorized to view. This issue occurs when a site is configured with a Webform containing a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own submissions or sending uploads as email attachments. Approximately 436,400 instances are identified globally.

The Webform module does not sufficiently restrict access to the custom attributes YAML editor. Users with permissions to create or edit webforms, but lacking permissions to edit the webform source, can add custom attributes. This flaw allows for stored cross-site scripting (XSS), a technique where malicious scripts are permanently stored on the target server and served to other users. Approximately 436,300 instances are identified globally.

Insufficient sanitization of tooltips and help text within the Webform module allows for cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess permissions to create or edit the affected Webform configuration or content. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

When the Webform module is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. This occurs when a webform is configured to allow authenticated users to view their own submissions, potentially causing a request to the JSON:API webform submission collection endpoint to return a cached response generated for a different user. Consequently, an authenticated user may view another user's webform submission data. Approximately 436,300 instances of Drupal were identified globally as potentially exposed. This issue requires JSON:API to be enabled, the affected webform to expose submissions through JSON:API, and the attacker to possess an account with permissions to view their own submissions.

يسمح خلل في التصريح في وحدة Webform Submission Export/Import الفرعية بحدوث تزوير طلبات من جانب الخادم (SSRF)، وهي حالة يمكن للمهاجم من خلالها دفع الخادم إلى إرسال طلبات إلى موقع غير مقصود. تفشل الوحدة الفرعية في التحقق بشكل كافٍ من الوصول إلى وظائف التصدير والاستيراد. وبناءً على ذلك، يمكن للمستخدم الذي يملك صلاحيات تحرير عمليات إرسال نماذج الويب والوصول إلى نتائجها الوصول إلى واجهة الاستيراد، بما في ذلك مسار استيراد URL عن بُعد.

يحدث ثغرة Cross-Site Scripting (XSS) مخزنة عندما لا يقوم الموديول بتقييد الوصول إلى تحرير مصدر نموذج الويب الخام بشكل كافٍ عندما يكون موديول Webform UI غير مفعل. يسمح هذا للمستخدم الذي لديه صلاحيات إنشاء أو تحرير نماذج الويب بإدخال تكوينات مصدر يتم عرضها بشكل غير آمن. XSS المخزن هو خلل أمني حيث يتم تخزين نص برمجى خبيث بشكل دائم على الخادم المستهدف ويتم تنفيذه في متصفح المستخدمين الذين يشاهدون الصفحة المتأثرة.

يؤدي عدم كفاية دقة التحكم في الوصول في وحدة Webform إلى السماح بالتصفح القسري. لا تقيد الوحدة بشكل كافٍ الوصول إلى تكوين معالجات عمليات HTTP عن بُعد، مما قد يسمح للمستخدم الذي لديه إذن بتحرير نموذج ويب بتكوين عملية HTTP عن بُعد.

تسمح مشكلة في التصريح غير الصحيح بالتصفح القسري عند تقديم عمليات تصدير البيانات المرسلة التي تم إنشاؤها. يفشل النموذج في التحقق بشكل كافٍ من أسماء الملفات المطلوبة، مما قد يسمح للمستخدم الذي لديه إذن لعرض نتائج الإرسال لنموذج ويب واحد بالوصول إلى ملفات من دليل التصدير المؤقت المكون أو إزالتها، وهي ملفات لم يتم إنشاؤها لهذا النموذج المحدد. يتطلب هذا أن يكون لدى المهاجم إذن لعرض نتائج الإرسال ومعرفة اسم الملف المستهدف.