DRUPAL-CONTRIB-2017-091 The Configuration Update Reports sub-module in the Configuration Update module project enables you to run reports to see what configuration
Unprivileged users can trick administrators into importing configuration via CSRF in the Configuration Update Reports module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2017-091?
DRUPAL-CONTRIB-2017-091 is a vulnerability in drupal/config_update, published on 6 Dec 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Configuration Update Reports sub-module in the Configuration Update module project enables you to run reports to see what configuration on your site differs from the configuration distributed by a module, theme, or installation profile, and to revert, delete, or import configuration.
This module doesn't sufficiently protect the Import operation, thereby exposing a Cross Site Request Forgery (CSRF) vulnerability which can be exploited by unprivileged users to trick an administrator into unwanted import of configuration.
This vulnerability is mitigated by the fact that only configuration items distributed with a module, theme, or installation profile that is currently installed and enabled on the site can be imported, not arbitrary configuration values.
Which versions are affected by DRUPAL-CONTRIB-2017-091?
Linux distribution packages (1)
drupal/config_update Packagist:https://packages.drupal.org/8 | All versions | 1.5.0 |
How do I fix DRUPAL-CONTRIB-2017-091?
Upgrade to a fixed version.
Is DRUPAL-CONTRIB-2017-091 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2017-091 in the wild and no public exploit code.