7 ms·

Security vulnerability in #Drupal contrib module puts 120000 sites at risk

35 points by velmu 10y ago

kyled 10y ago
Looking at the source it took me < 5 minutes to find the actual vuln =/. Drupal saying "Just migrate away" is not the correct way to handle this disclosure. Some people can't switch immediately. A patch should be made available, and the module should be depreciated. Does Drupal have a way to update modules easily? If not, there should be...
- YCode 10y ago
  They probably don't want to get into the realm of maintaining user contributed modules. They do offer an alternative (Entity Reference) and asked if anyone would patch or maintain the module. They also added a warning on the module's page.
  - kyled 10y ago
    Looks like someone is writing a patch already.
- ketralnis 10y ago
  > Some people can't switch immediately. A patch should be made available, and the module should be depreciated Maybe that's what should happen, but it's not what will happen. The module is unmaintained. Who do you suggest should do it? Will you? If not then you're just demanding that work should be done somewhere, by someone else, without providing any path or resources for it. That's just not how freely contributed and shared labour works. It's a risk you take on when you use that free resource, and why it matters to contribute back to the ecosystem that you're using free of charge. Frankly, if you've been using the freely available module for this long then you're already ahead of where you were before. "This software is broken so you shouldn't use it" is absolutely a perfectly reasonable solution to the problem, and nobody owes you anything more.
  - kyled 10y ago
    > The module is unmaintained. Who do you suggest should do it? Will you? Yes. I am contacting the security team and working on a patch already. The page mentions someone is currently working on the issue already however. > "This software is broken so you shouldn't use it" is absolutely a perfectly reasonable solution. I don't completely agree. If it's unmaintained, new installations shouldn't use it, totally agree. That doesn't help the 120K installations which are using the plugin though. It may take more time to impedance match apis, rather then fixing the security issue.
- deanclatworthy 10y ago
  Same. Took hardly any time to see the SQL injection. I wonder how many more of these there are on older installations using modules that are no longer actively maintained (Hint: probably lots. Code quality has come a long way since the early days of Drupal.)
  - phil21 10y ago
    As someone who used to host many Drupal installs - all of them. The joke around the ops/security team was Drupal is a remote shell with a bonus CMS attached to it.
    - ohthehugemanate 10y ago
      When was it, what versions of Drupal? 8 ended up as a massive rewrite to replace all the key parts with Symfony components.
    - kahnpro 10y ago
      I've always used this joke for Wordpress... a remote shell with a blog attached to it.
  - AlbertQQA 10y ago
    > Took hardly any time to see the SQL injection. You sure you saw it correctly? Concatenation of hardcoded variants (poor-mans query builder) doesn't make an injection.
    - lightlyused 10y ago
      I saw that one too, I think it is something in the node_references auto_complete menu task. To lazy to test, I've got plumbing work to do.
      - AlbertQQA 10y ago
        All I'm seeing is a missing db_like which means a user can search for "%foo%bar%" instead of just "foo%bar". This is not a SQL-injection, nor a relevant issue. The problem is in that function though. It is missing a condition for publication status. Titles of unpublished nodes should render for some users, but not all.
orf 10y ago
> Drupal is known for it's large number of community contributed modules that add functionality to the bare bones core system. No, it's known for its ridiculous number of security issues and sloppy code :/
- ksenzee 10y ago
  Drupal is easy to criticize, but its handling of security issues and its code quality aren't the two places I'd start. They're actually two of the strengths of the project.
  - jacquesm 10y ago
    You're missing a /s there.
    - mschuster91 10y ago
      I've seen worse, way worse, than Drupal Core. That of course does not include Drupal modules - there is, similar to the Wordpress ecosystem, the really bad stuff.
      - jacquesm 10y ago
        But that's the whole problem right there. Such a plug-in architecture with every Tom, Dick & Jane writing modules that are loosely vetted and deployed in the 100's of thousands is broken by design. There is no way a small review team focused on security will be able to audit what 1000's of dedicated lesser gods produce. I can see the advantage of it, you just focus on the core and let the world take care of its own problems but you end up with nearly every site being critically dependent on a couple of obscure modules that will not get the attention they need until it is much too late. This coupled with Drupals nasty habit of obsoleting everything every couple of year (I hear they are changing now) and you're set up for disaster. So even if Drupal Core is not all that bad it is never just Drupal Core.
        10y ago
janwillemb 10y ago
Title is: Security vulnerability in unmaintained Drupal contrib module puts 120000 sites at risk (Emphasis mine)

35 points by velmu 10y ago

kyled 10y ago

Looking at the source it took me < 5 minutes to find the actual vuln =/. Drupal saying "Just migrate away" is not the correct way to handle this disclosure. Some people can't switch immediately. A patch should be made available, and the module should be depreciated. Does Drupal have a way to update modules easily? If not, there should be...

YCode 10y ago
They probably don't want to get into the realm of maintaining user contributed modules. They do offer an alternative (Entity Reference) and asked if anyone would patch or maintain the module. They also added a warning on the module's page.
- kyled 10y ago
  Looks like someone is writing a patch already.
ketralnis 10y ago
> Some people can't switch immediately. A patch should be made available, and the module should be depreciated Maybe that's what should happen, but it's not what will happen. The module is unmaintained. Who do you suggest should do it? Will you? If not then you're just demanding that work should be done somewhere, by someone else, without providing any path or resources for it. That's just not how freely contributed and shared labour works. It's a risk you take on when you use that free resource, and why it matters to contribute back to the ecosystem that you're using free of charge. Frankly, if you've been using the freely available module for this long then you're already ahead of where you were before. "This software is broken so you shouldn't use it" is absolutely a perfectly reasonable solution to the problem, and nobody owes you anything more.
- kyled 10y ago
  > The module is unmaintained. Who do you suggest should do it? Will you? Yes. I am contacting the security team and working on a patch already. The page mentions someone is currently working on the issue already however. > "This software is broken so you shouldn't use it" is absolutely a perfectly reasonable solution. I don't completely agree. If it's unmaintained, new installations shouldn't use it, totally agree. That doesn't help the 120K installations which are using the plugin though. It may take more time to impedance match apis, rather then fixing the security issue.
deanclatworthy 10y ago
Same. Took hardly any time to see the SQL injection. I wonder how many more of these there are on older installations using modules that are no longer actively maintained (Hint: probably lots. Code quality has come a long way since the early days of Drupal.)
- phil21 10y ago
  As someone who used to host many Drupal installs - all of them. The joke around the ops/security team was Drupal is a remote shell with a bonus CMS attached to it.
  - ohthehugemanate 10y ago
    When was it, what versions of Drupal? 8 ended up as a massive rewrite to replace all the key parts with Symfony components.
  - kahnpro 10y ago
    I've always used this joke for Wordpress... a remote shell with a blog attached to it.
- AlbertQQA 10y ago
  > Took hardly any time to see the SQL injection. You sure you saw it correctly? Concatenation of hardcoded variants (poor-mans query builder) doesn't make an injection.
  - lightlyused 10y ago
    I saw that one too, I think it is something in the node_references auto_complete menu task. To lazy to test, I've got plumbing work to do.
    - AlbertQQA 10y ago
      All I'm seeing is a missing db_like which means a user can search for "%foo%bar%" instead of just "foo%bar". This is not a SQL-injection, nor a relevant issue. The problem is in that function though. It is missing a condition for publication status. Titles of unpublished nodes should render for some users, but not all.

orf 10y ago

> Drupal is known for it's large number of community contributed modules that add functionality to the bare bones core system. No, it's known for its ridiculous number of security issues and sloppy code :/

ksenzee 10y ago
Drupal is easy to criticize, but its handling of security issues and its code quality aren't the two places I'd start. They're actually two of the strengths of the project.
- jacquesm 10y ago
  You're missing a /s there.
  - mschuster91 10y ago
    I've seen worse, way worse, than Drupal Core. That of course does not include Drupal modules - there is, similar to the Wordpress ecosystem, the really bad stuff.
    - jacquesm 10y ago
      But that's the whole problem right there. Such a plug-in architecture with every Tom, Dick & Jane writing modules that are loosely vetted and deployed in the 100's of thousands is broken by design. There is no way a small review team focused on security will be able to audit what 1000's of dedicated lesser gods produce. I can see the advantage of it, you just focus on the core and let the world take care of its own problems but you end up with nearly every site being critically dependent on a couple of obscure modules that will not get the attention they need until it is much too late. This coupled with Drupals nasty habit of obsoleting everything every couple of year (I hear they are changing now) and you're set up for disaster. So even if Drupal Core is not all that bad it is never just Drupal Core.
      - 10y ago

janwillemb 10y ago

Title is: Security vulnerability in unmaintained Drupal contrib module puts 120000 sites at risk (Emphasis mine)