Marcus Johansson

This module provides a framework for integrating AI providers and features into Drupal. The issue occurs because the module does not sufficiently sanitize certain HTMX attributes, leading to Cross-Site Scripting (XSS), where malicious scripts can be injected into web pages.

A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize user-supplied content before saving it to the public file system. This allows a maliciously crafted file to contain active or unsafe content that can be executed in the browser of other users.

An incorrect authorization issue allows forceful browsing, where users without the required permissions can access the bulk update form used for assigning or removing roles on multiple user accounts. This is mitigated by the requirement that an attacker must already possess a role with the "administer users" permission.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The module does not sufficiently validate Markdown links under certain conditions, which can lead to the execution of malicious scripts in the user's browser.

An issue exists where the module does not sufficiently validate file URLs for malicious content during fallback retrieval. This leads to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. Exploitation requires the module to be enabled on the target site and the attacker to have the ability to upload a malicious file to the configured origin server.

An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to license fields for users possessing the `update own commerce license` permission. Consequently, a license owner can modify the license state and the rights granted by their license, potentially leading to privilege escalation up to the Administrator role.

Stored Cross-site Scripting (XSS) occurs due to improper neutralization of input during web page generation. The AI Automator submodule, which enables automatic field population based on other fields, fails to sufficiently verify access to text formats. This allows users to author field data using text formats they are not authorized to use.

An incorrect authorization issue allows forceful browsing when a store is saved. The system fails to properly verify access permissions, enabling a user with the ability to create stores or edit their own store to mark it as the site's default store. This allows the user to receive orders they are not authorized to access. This issue primarily impacts sites that grant these permissions to untrusted users, such as marketplace platforms where vendors manage their own stores.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify access to the relationship between promotions and coupons. Consequently, a user authorized only to manage their own promotions can modify or delete coupons associated with other promotions. This issue is mitigated if the site does not enable writes through JSON:API or REST, as these are disabled by default.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The module does not sufficiently restrict HTML rendering, which enables the execution of malicious scripts under certain conditions. This issue is mitigated by the requirement that an attacker must have access to a text format capable of rendering HTML.

An issue exists where the module does not sufficiently restrict product variations returned by entity queries to those the current user is authorized to view. When the core JSON:API module is enabled, an attacker can perform forceful browsing by making repeated requests to determine field values of unpublished product variations or variations of unpublished products.

An issue in the AI Chatbot submodule occurs when user input is not sufficiently filtered before being rendered on a web page, leading to Cross-Site Scripting (XSS). This occurs under certain configurations and requires the attacker to have permissions to administer blocks.

Incorrect authorization in the AI module allows resource injection. The module fails to sufficiently validate links under specific conditions, which could lead to the exfiltration of sensitive information to external sites. This occurs when an attacker uses untrusted sources to interact with the module in a manner that produces rendered HTML.

Incorrectly configured access control security levels in the AI Search submodule allow the web browser cache to contain sensitive information. While the AI Search backend verifies access for each search result, this check is ignored when Search API caches view results. Consequently, users may see cached search results, such as titles and fields of unpublished or restricted content, if a user with appropriate permissions performed the same search within the cache lifetime. This occurs when the AI Search submodule is enabled and a Search API view uses time-based, tag-based, or combined time and tag-based result caching.

Cross-Site Request Forgery (CSRF) occurs when a user is tricked into performing an action they did not intend to do. In this case, routes for the inbox do not verify CSRF tokens. An attacker can deceive a user with the "access commerce administration pages" permission into visiting a malicious page that dismisses notifications. Because the inbox is shared, this action hides messages, including security update notices, from all administrators.

Insecure storage of sensitive information occurs when audio files for speech-to-text requests are written to a single file in the temporary directory and are not deleted after processing. This allows an attacker with read access to the site's temporary directory—potentially via shared hosting or other code exposing temporary files—to retrieve audio data sent by other users for transcription.

An issue exists in Drupal Patreon that affects the software's security.

An OS Command Injection issue exists because the module does not sufficiently sanitize file names passed to the ffmpeg command-line interface tool. This allows for the improper neutralization of special elements used in an OS command. Exploitation requires the attacker to have the ability to upload images to the site.

An authentication bypass exists in the Drupal Domain Login Restrict module, which is designed to restrict user logins on multi-domain sites to only assigned domains. The module fails to sufficiently enforce these restrictions when a user authenticates via a method other than the standard login form. Exploitation requires the attacker to possess a valid user account and for the "Enable restriction" setting to be active on the Domain settings page. Users granted the "Login to any domain" permission are not impacted.