Liam Morland

Insufficient granularity of access control in the Webform module allows forceful browsing. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers, which could allow a user with permission to edit a webform to configure a remote HTTP operation.

The Webform module fails to sufficiently exclude certain format templates from token replacement. This allows an attacker to submit data that is evaluated as template code during the rendering of a submission. Depending on the site configuration and enabled modules, this can result in remote code execution, stored cross-site scripting (XSS), or information disclosure. This issue is mitigated if the webform is not configured with a custom multiple-value item format that includes submission-value tokens. Approximately 436,300 instances were identified globally.

An issue exists where user-specific access rules are not sufficiently guarded against malformed saved configurations. Under specific site conditions, an access rule designed to restrict submission access to selected user accounts may inadvertently grant access to anonymous users. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

The Webform Entity Print submodule does not sufficiently limit access to its print templates. A user with permissions to create and edit their own webforms can exploit this to perform cross-site scripting (XSS) within the submodule settings. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

The Webform Share submodule, which allows site builders to expose webforms for embedding on other sites, contains a flaw where submissions for Ajax-enabled webforms can bypass anti-spam protections. This occurs when the webform relies on compatible Form-API-based anti-spam protections, such as Honeypot or Antibot. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

The Webform module fails to sufficiently validate an optional token query value. In specific configurations where a form is rendered for anonymous visitors, a malicious request can cause excessive resource consumption, resulting in a Denial of Service. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

The Webform module does not sufficiently restrict access to the custom attributes YAML editor. Users with permissions to create or edit webforms, but lacking permissions to edit the webform source, can add custom attributes. This flaw allows for stored cross-site scripting (XSS), a technique where malicious scripts are permanently stored on the target server and served to other users. Approximately 436,300 instances are identified globally.

Stored Cross-Site Scripting (XSS) occurs when the module does not sufficiently restrict access to raw webform source editing while the Webform UI module is disabled. This allows a user with permissions to create or edit webforms to input source configuration that is rendered unsafely. Stored XSS is a security flaw where a malicious script is permanently stored on the target server and executed in the browser of users who view the affected page.

Incorrect authorization in the module allows forceful browsing. The module fails to sufficiently verify permissions for creating, viewing, and updating the parent webform when accessing REST endpoints. This issue requires the attacker to already possess permissions to use the REST resource.