DRUPAL-CONTRIB-2021-015 Chaos tool suite (ctools) module provides a number of APIs and extensions for Drupal, its 8.x-3.x branch is a start from scratch to evaluate
Attackers can bypass block access controls in the Drupal ctools module if custom access methods are implemented, potentially viewing restricted content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2021-015?
DRUPAL-CONTRIB-2021-015 is a missing authorization vulnerability in drupal/ctools, published on 16 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Chaos tool suite (ctools) module provides a number of APIs and extensions for Drupal, its 8.x-3.x branch is a start from scratch to evaluate the features of ctools that didn't make it into Drupal Core 8.0.x and port them.
The module doesn't sufficiently handle block access control on its EntityView plugin. This is a followup to more fully implement the fixes from SA-CONTRIB-2021-009
This vulnerability is mitigated by the fact that successful exploitation requires special conditions in place such as custom blockAccess() method that differs from the default return value of 'AccessResult::allowed()' and extending from EntityView.
Which versions are affected by DRUPAL-CONTRIB-2021-015?
Linux distribution packages (1)
drupal/ctools Packagist:https://packages.drupal.org/8 | All versions | 3.7.0 |
How do I fix DRUPAL-CONTRIB-2021-015?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2021-015 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2021-015 in the wild and no public exploit code.