DRUPAL-CONTRIB-2023-034 The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes.
An attacker with admin-type permissions can achieve remote code execution via unsafe object injection in the Drupal ACL module.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2023-034?
DRUPAL-CONTRIB-2023-034 is an unsafe deserialization vulnerability in drupal/acl, published on 23 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes.
The module processes user input in a way that could be unsafe. This can lead to Remote Code Execution via Object Injection.
As this is an API module, it is only exploitable if a "client" module exposes the vulnerability. Details of some contributed client modules are given below. Custom modules using ACL could also expose the vulnerability.
This vulnerability is mitigated by the fact that an attacker typically needs an "admin"-type permission provided by one of ACL's client modules.
Known client modules include:
- Forum Access
- Flexi Access
- Content Access
Coordinated Security Advisories are being released for those client modules that have Security coverage.
Which versions are affected by DRUPAL-CONTRIB-2023-034?
Linux distribution packages (1)
drupal/acl Packagist:https://packages.drupal.org/8 | All versions | 1.0.0 |
How do I fix DRUPAL-CONTRIB-2023-034?
Apply the vendor's patch.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is DRUPAL-CONTRIB-2023-034 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2023-034 in the wild and no public exploit code.