DRUPAL-CONTRIB-2021-005 The [Fast Autocomplete module](https://www.drupal.org/project/fac) provides fast IMDB-like suggestions below a text input field.
A malicious user can read search results from other roles if the anonymous search setting is disabled, disclosing unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2021-005?
DRUPAL-CONTRIB-2021-005 is a vulnerability in drupal/fac, published on 17 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Fast Autocomplete module provides fast IMDB-like suggestions below a text input field. Suggestions are stored as JSON files in the public files folder so that they can be provided to the browser relatively fast without the need for Drupal to be bootstrapped.
The module doesn't correctly generate certain hashes when the configuration option "Perform search as anonymous user only" is switched from the default on value to off.
This enables a malicious user to read search results generated by users with other roles, disclosing search results the user normally has no access to.
Which versions are affected by DRUPAL-CONTRIB-2021-005?
Linux distribution packages (1)
drupal/fac Packagist:https://packages.drupal.org/8 | All versions | 1.8.0 |
How do I fix DRUPAL-CONTRIB-2021-005?
Apply the vendor's patch.
Is DRUPAL-CONTRIB-2021-005 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2021-005 in the wild and no public exploit code.