Jacob Rockowitz

An incorrect authorization issue allows forceful browsing within the Webform module. The module fails to sufficiently restrict access to specific submission view modes. Consequently, a user with permission to view a submission may access a more permissive view mode to see fields that should be restricted. This requires the attacker to already possess access to view the affected submission.

The Webform module fails to sufficiently exclude certain format templates from token replacement. This allows an attacker to submit data that is evaluated as template code during the rendering of a submission. Depending on the site configuration and enabled modules, this can result in remote code execution, stored cross-site scripting (XSS), or information disclosure. This issue is mitigated if the webform is not configured with a custom multiple-value item format that includes submission-value tokens. Approximately 436,300 instances were identified globally.

An issue exists where user-specific access rules are not sufficiently guarded against malformed saved configurations. Under specific site conditions, an access rule designed to restrict submission access to selected user accounts may inadvertently grant access to anonymous users. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

The Webform module fails to properly force the download of certain uploaded file types when they are served. In specific site configurations, a file uploaded via a webform can be rendered inline by a browser, leading to cross-site scripting (XSS), where malicious scripts are executed in the victim's browser. Approximately 436,300 instances were identified globally. This issue requires a user with permissions to create or edit webforms to allow the affected file extensions, and a victim must manually open the uploaded file.

The Webform module contains a rating element that does not sufficiently validate data. This flaw could allow cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, on pages containing a rating element. Exploitation requires the attacker to be able to place crafted HTML markup on the same page as the rating element. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

The Webform module fails to sufficiently sanitize attributes used by its color element. This can lead to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, when the element is rendered. Exploitation requires the attacker to add a specially crafted link with a specific class to the same page as the affected webform. Approximately 436,400 instances of Drupal were identified globally as potential targets.

An issue exists in the Webform module, which is used to create forms and collect submissions. Due to improper sanitization of announcement text used for assistive technologies, specially crafted input can lead to cross-site scripting. Approximately 436,400 instances of Drupal were identified globally as potentially exposed. Remote code execution is also possible.

The Webform module fails to sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. This flaw allows markup from counter-related settings to be inserted into the page, resulting in cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. Exploitation requires the attacker to have permissions to create or edit affected Webform elements or to place crafted counter markup on a page where the Webform counter JavaScript is active. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

The Webform module, used for creating forms and processing submissions, contains a flaw in how it handles Remote Post handlers. These handlers send data to external servers via APIs. The module fails to sufficiently filter response values from the Remote Post handler before they are rendered through handler response tokens. Consequently, if a site uses these tokens in rendered output, a remote endpoint could return values that are rendered as HTML, leading to cross-site scripting (XSS), where malicious scripts are injected into trusted websites. Approximately 436,300 instances were identified globally.

The Webform Entity Print submodule does not sufficiently limit access to its print templates. A user with permissions to create and edit their own webforms can exploit this to perform cross-site scripting (XSS) within the submodule settings. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

The Webform Share submodule, which allows site builders to expose webforms for embedding on other sites, contains a flaw where submissions for Ajax-enabled webforms can bypass anti-spam protections. This occurs when the webform relies on compatible Form-API-based anti-spam protections, such as Honeypot or Antibot. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

The Webform module fails to sufficiently validate an optional token query value. In specific configurations where a form is rendered for anonymous visitors, a malicious request can cause excessive resource consumption, resulting in a Denial of Service. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they are not authorized to view. This issue occurs when a site is configured with a Webform containing a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own submissions or sending uploads as email attachments. Approximately 436,400 instances are identified globally.

The Webform module does not sufficiently restrict access to the custom attributes YAML editor. Users with permissions to create or edit webforms, but lacking permissions to edit the webform source, can add custom attributes. This flaw allows for stored cross-site scripting (XSS), a technique where malicious scripts are permanently stored on the target server and served to other users. Approximately 436,300 instances are identified globally.

Insufficient sanitization of tooltips and help text within the Webform module allows for cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess permissions to create or edit the affected Webform configuration or content. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

When the Webform module is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. This occurs when a webform is configured to allow authenticated users to view their own submissions, potentially causing a request to the JSON:API webform submission collection endpoint to return a cached response generated for a different user. Consequently, an authenticated user may view another user's webform submission data. Approximately 436,300 instances of Drupal were identified globally as potentially exposed. This issue requires JSON:API to be enabled, the affected webform to expose submissions through JSON:API, and the attacker to possess an account with permissions to view their own submissions.

An incorrect authorization issue in the Webform Submission Export/Import submodule allows for Server Side Request Forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The submodule fails to sufficiently validate access to its export and import functionality. Consequently, a user with permissions to edit webform submissions and access webform results can access the import interface, including the remote URL import path.

Stored Cross-Site Scripting (XSS) occurs when the module does not sufficiently restrict access to raw webform source editing while the Webform UI module is disabled. This allows a user with permissions to create or edit webforms to input source configuration that is rendered unsafely. Stored XSS is a security flaw where a malicious script is permanently stored on the target server and executed in the browser of users who view the affected page.

Insufficient granularity of access control in the Webform module allows forceful browsing. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers, which could allow a user with permission to edit a webform to configure a remote HTTP operation.

An incorrect authorization issue allows forceful browsing when serving generated submission exports. The module fails to sufficiently validate requested filenames, which may allow a user with permission to view submission results for one webform to access or remove files from the configured export temporary directory that were not intended for that specific webform. This requires the attacker to have permission to view submission results and knowledge of the target filename.