Juraj Nemec

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x.

Single Content Sync allows exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution via Object Injection. This issue requires the attacker to possess a role with the "import single content" permission.

An incorrect authorization issue allows forceful browsing when Drupal Commerce is used in conjunction with the JSON:API module. This allows users without proper permissions to access unpublished product variations. This issue specifically affects sites that maintain both published products and unpublished product variations.

This module provides a framework for integrating AI providers and features into Drupal. The issue occurs because the module does not sufficiently sanitize certain HTMX attributes, leading to Cross-Site Scripting (XSS), where malicious scripts can be injected into web pages.

An incorrect authorization issue exists in the module used for organizing tangible products into shipments for fulfillment. The system fails to sufficiently verify access permissions on the form used to resend receipts. Under specific configurations, this allows unauthorized users to perform forceful browsing to access receipts and sensitive customer information for orders they are not permitted to view.

Single Content Sync allows exporting and importing content, referenced entities, and files between Drupal sites. The module fails to sufficiently validate file sources and destinations during content imports, leading to Path Traversal. This allows an attacker to write arbitrary files, disclose sensitive local files accessible to the web server, or trigger requests to internal or external resources. Depending on server configuration, this may result in remote code execution. Exploitation requires the *import single content* permission.

Incorrect authorization in the AI module allows resource injection. The module fails to sufficiently validate links under specific conditions, which could lead to the exfiltration of sensitive information to external sites. This occurs when an attacker uses untrusted sources to interact with the module in a manner that produces rendered HTML.

An issue in the AI Chatbot submodule occurs when user input is not sufficiently filtered before being rendered on a web page, leading to Cross-Site Scripting (XSS). This occurs under certain configurations and requires the attacker to have permissions to administer blocks.

Incorrectly configured access control security levels in the AI Search submodule allow the web browser cache to contain sensitive information. While the AI Search backend verifies access for each search result, this check is ignored when Search API caches view results. Consequently, users may see cached search results, such as titles and fields of unpublished or restricted content, if a user with appropriate permissions performed the same search within the cache lifetime. This occurs when the AI Search submodule is enabled and a Search API view uses time-based, tag-based, or combined time and tag-based result caching.

Insecure storage of sensitive information occurs when audio files for speech-to-text requests are written to a single file in the temporary directory and are not deleted after processing. This allows an attacker with read access to the site's temporary directory—potentially via shared hosting or other code exposing temporary files—to retrieve audio data sent by other users for transcription.

An authentication bypass exists in the module that enables authentication via the OpenID Connect (oAuth2) protocol. When a new user logs in, the module attempts to link the user to an existing account sharing the same email address. This allows an attacker to take over any existing Drupal account, excluding user 1, provided the account has not yet been linked to an OpenID Connect user. This issue is more likely to occur if the site is configured to use a provider that does not verify user email addresses.

An incorrect authorization issue allows forceful browsing within the module used for organizing tangible products into shipments for fulfillment. The module fails to sufficiently protect shipment references and shipment entity fields, leading to an access bypass. This can result in the unauthorized modification of shipment states or the deletion of shipments. Exploitation requires the attacker to possess a cart with API-based access to manipulate shipments.

A Cross-Site Request Forgery (CSRF) issue exists in the module used for Stripe Connect API integration. When redirecting to Stripe Connect to generate an authorization code, the module fails to include a CSRF token in the return URI. This allows an attacker to deceive an administrator into clicking a link that bypasses the payment process, resulting in orders being marked as paid without actual payment being processed.

Improper verification of cryptographic signatures in the module allows for signature spoofing. The issue occurs when a signing secret is not properly configured in the payment gateway settings, leading to insufficient verification of webhook event signatures. Webhooks are automated messages sent from Stripe to the application to notify it about events, such as successful payments.

Stored Cross-site Scripting (XSS) occurs due to improper neutralization of input during web page generation. The AI Automator submodule, which enables automatic field population based on other fields, fails to sufficiently verify access to text formats. This allows users to author field data using text formats they are not authorized to use.

A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify access to the relationship between promotions and coupons. Consequently, a user authorized only to manage their own promotions can modify or delete coupons associated with other promotions. This issue is mitigated if the site does not enable writes through JSON:API or REST, as these are disabled by default.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The module does not sufficiently restrict HTML rendering, which enables the execution of malicious scripts under certain conditions. This issue is mitigated by the requirement that an attacker must have access to a text format capable of rendering HTML.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The module does not sufficiently validate Markdown links under certain conditions, which can lead to the execution of malicious scripts in the user's browser.

A security issue exists in the Drupal CacheFlush project. The project is currently marked as unsupported, and the issue remains unresolved by the maintainer.