Damien Mckenna

An authentication bypass issue exists where the module fails to fully invalidate a solved CAPTCHA session. This allows a protected form that has been submitted once to be submitted again without solving a new challenge. This flaw weakens protection against automated submissions, including login brute-forcing, comment spam, and spam registrations.

A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

Insecure storage of sensitive information allows for the retrieval of embedded sensitive data. The module fails to sufficiently encrypt the password of the system user utilized during content synchronization, which may allow unprivileged users to view the password. Exploitation requires the attacker to have prior database read access or a database dump of the user data table.

Incorrectly configured access control security levels allow the caching of token permissions in a manner that enables them to be reused for another user's token sharing the same scopes. This can lead to a user gaining unauthorized permissions, including administrative access. Exploitation requires a more privileged user's token with identical scopes to be used first.

An Unsafe Reflection issue exists where externally-controlled input can be used to select classes or code, leading to Reflection Injection. This flaw allows for remote code execution. While the issue is not directly exploitable using the module in isolation, multiple serious exploit paths exist when combined with other contributed modules, including at least one path that does not require authentication. Custom code may also expose this functionality.

An issue exists where the module does not sufficiently sanitize certain attributes, leading to cross-site scripting (XSS), a flaw that allows attackers to inject malicious scripts into web pages. Approximately 15,300 instances have been identified globally. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

An improper check for unusual or exceptional conditions allows forceful browsing. The issue occurs when the module is in Permission mode and a node referencing a deleted taxonomy term is accessed via the JSON:API. This requires a specific module configuration and the presence of references to a deleted term to be exploited.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. The issue occurs because the autocomplete widget does not sufficiently escape user input. This cannot occur in a default installation and requires the presence of additional modules or custom code.

The Webform module fails to sufficiently validate an optional token query value. In specific configurations where a form is rendered for anonymous visitors, a malicious request can cause excessive resource consumption, resulting in a Denial of Service. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they are not authorized to view. This issue occurs when a site is configured with a Webform containing a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own submissions or sending uploads as email attachments. Approximately 436,400 instances are identified globally.

When the Webform module is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. This occurs when a webform is configured to allow authenticated users to view their own submissions, potentially causing a request to the JSON:API webform submission collection endpoint to return a cached response generated for a different user. Consequently, an authenticated user may view another user's webform submission data. Approximately 436,300 instances of Drupal were identified globally as potentially exposed. This issue requires JSON:API to be enabled, the affected webform to expose submissions through JSON:API, and the attacker to possess an account with permissions to view their own submissions.

An incorrect authorization issue in the Webform Submission Export/Import submodule allows for Server Side Request Forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The submodule fails to sufficiently validate access to its export and import functionality. Consequently, a user with permissions to edit webform submissions and access webform results can access the import interface, including the remote URL import path.

Stored Cross-Site Scripting (XSS) occurs when the module does not sufficiently restrict access to raw webform source editing while the Webform UI module is disabled. This allows a user with permissions to create or edit webforms to input source configuration that is rendered unsafely. Stored XSS is a security flaw where a malicious script is permanently stored on the target server and executed in the browser of users who view the affected page.

Cross-Site Request Forgery (CSRF) occurs when the module does not sufficiently validate certain requests. This allows an attacker to trick an authenticated user into performing unintended actions. CSRF is a flaw where a malicious website causes a user's web browser to perform an unwanted action on a different website where the user is currently authenticated.

The Webform Share submodule, which allows site builders to expose webforms for embedding on other sites, contains a flaw where submissions for Ajax-enabled webforms can bypass anti-spam protections. This occurs when the webform relies on compatible Form-API-based anti-spam protections, such as Honeypot or Antibot. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

The Webform module does not sufficiently restrict access to the custom attributes YAML editor. Users with permissions to create or edit webforms, but lacking permissions to edit the webform source, can add custom attributes. This flaw allows for stored cross-site scripting (XSS), a technique where malicious scripts are permanently stored on the target server and served to other users. Approximately 436,300 instances are identified globally.

An incorrect authorization issue exists in the module used to restrict access to JSON:API routes based on user roles. The module fails to sufficiently enforce access controls when a request mimics an XMLHttpRequest (a browser object used to interact with pages without reloading), which allows forceful browsing.

An incorrect authorization issue allows forceful browsing. The module, which manages permissions per node content type to control access to unpublished content, incorrectly allows view access for published content, overriding other existing access mechanisms.

Insufficient access restrictions on the delete form allow forceful browsing, which occurs when a user accesses a page or resource without proper authorization. This issue allows unauthorized users to delete webform submissions in bulk using a specified date range.

A missing authorization issue allows forceful browsing when viewing images using the photoswipe image gallery display formatter. The module fails to sufficiently check access permissions, which may allow unauthorized users to view images that should be restricted.