DRUPAL-CONTRIB-2018-001 This module enables content editors to create complex pages and layouts on the fly without the help from a developer, using reusable widgets.
An attacker with editor privileges can execute arbitrary code via the AJAX endpoint if the Content Feed submodule is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2018-001?
DRUPAL-CONTRIB-2018-001 is a code injection vulnerability in drupal/stacks, published on 10 Jan 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This module enables content editors to create complex pages and layouts on the fly without the help from a developer, using reusable widgets.
The module does not sufficiently filter values posted to its AJAX endpoint, which leads to the instantiation of an arbitrary PHP class.
This vulnerability is mitigated by the fact that only sites with the Stacks - Content Feed submodule enabled are affected.
Which versions are affected by DRUPAL-CONTRIB-2018-001?
Linux distribution packages (1)
drupal/stacks Packagist:https://packages.drupal.org/8 | All versions | 1.1.0 |
How do I fix DRUPAL-CONTRIB-2018-001?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is DRUPAL-CONTRIB-2018-001 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2018-001 in the wild and no public exploit code.