Drupal has released versions 6.38, 7.43 and 8.0.4 to patch a total of ten vulnerabilities, including one rated critical.
According to an advisory published on Wednesday, the most serious vulnerability is a critical Form API access bypass issue affecting Drupal 6. An attacker can exploit the flaw to submit input associated with buttons that should be blocked for non-administrators. For example, if there is a form that both admins and non-admins can access, but certain submit buttons are only available to administrators, an attacker who has access to that form can use the restricted buttons.
The updates, which have an overall rating of “critical,” also patch a moderately critical file upload access bypass and denial-of-service (DoS) vulnerability affecting Drupal 7 and 8. The flaw, present in the File module, allows an attacker who has permission to create content and upload files to view, delete or replace a link to a file uploaded by the victim. An attacker can leverage the security hole to block all file uploads to a website.
Another moderately critical issue affects Drupal 6 and 7 and it can be leveraged to brute-force user passwords via the XML-RPC system. Developers pointed out that the vulnerability can only be exploited if a module that provides an XML-RPC method that is vulnerable to brute-forcing is present. Drupal 6 is vulnerable due to the use of the Blog API module, but there aren’t any such modules in Drupal 7.
Drupal 6, 7 and 8 are plagued by an open redirect vulnerability that can be exploited via path manipulation. Developers have also assigned a “moderately critical” rating to a reflected file download flaw in Drupal 6 and 7, and an open redirect protection bypass issue in Drupal 6.
Another Drupal 6 flaw rated “moderately critical” can be exploited for HTTP header injection attacks when user-generated content containing line breaks is passed as a header value on websites running PHP versions prior to 5.1.2.
The latest Drupal updates also fix three less critical vulnerabilities: one that can result in a user being granted all roles when a user account is saved (versions 6 and 7), an issue that allows attackers to leverage the forgotten password feature to match an email address to a username (versions 7 and 8), and a possible remote code execution bug related to user data unserialization (version 6).
The flaws patched with the release of Drupal 6.38, 7.43 and 8.0.4 have been identified by several external researchers and members of the Drupal Security Team. Users are advised to update their installations as soon as possible.
This is the last security update released for Drupal 6, which has reached end of life on February 24. The Drupal Security Team announced that it will still be working with three vendors that want to provide paid support for Drupal 6 websites.
The companies that will receive Drupal 6 Long Term Support (D6 LTS) will publicly release all their patches on the D6 LTS project page. However, Drupal noted that the LTS vendors will likely stop providing patches if Drupal 6 website owners will not pay for their work.
