DRUPAL-CONTRIB-2017-083 Custom Permissions is a lightweight module that allows permissions to be created and managed through an administrative form.
Authenticated users can bypass custom access controls on protected pages by triggering cache rebuilds in the Custom Permissions module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2017-083?
DRUPAL-CONTRIB-2017-083 is an authentication bypass vulnerability in drupal/config_perms, published on 8 Nov 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Custom Permissions is a lightweight module that allows permissions to be created and managed through an administrative form.
When this module is in use, any user who is able to perform an action which rebuilds some of Drupal's caches can trigger a scenario in which certain pages protected by this module's custom permissions temporarily lose those custom access controls, thereby leading to an access bypass vulnerability.
Which versions are affected by DRUPAL-CONTRIB-2017-083?
Linux distribution packages (1)
drupal/config_perms Packagist:https://packages.drupal.org/8 | All versions | 1.1.0 |
How do I fix DRUPAL-CONTRIB-2017-083?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is DRUPAL-CONTRIB-2017-083 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2017-083 in the wild and no public exploit code.