Drupal ‘Janrain Capture’模块开放重定向漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1172565 漏洞类型 输入验证
发布时间 2012-06-19 更新时间 2012-06-19
CVE编号 CVE-2012-2727 CNNVD-ID CNNVD-201206-293
漏洞平台 N/A CVSS评分 5.8
|漏洞来源
https://cxsecurity.com/issue/WLB-2012060161
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201206-293
|漏洞详情
Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。Drupal中的JanrainCapture模块中存在开放重定向漏洞,该漏洞源于应用程序对用户提供的输入未经正确的验证。攻击者可利用该漏洞构造一个特制的URL诱使用户打开。当不知情受害者打开连接时,可重定向到攻击者控制的网站,有助于钓鱼攻击,也可能存在其他攻击。JanrainCapture6.x-1.0版本和7.x-1.0版本中存在漏洞,其他版本也可能受到影响。
|漏洞EXP
View online: http://drupal.org/node/1632734

  * Advisory ID: DRUPAL-SA-CONTRIB-2012-098
  * Project: Janrain Capture [1] (third-party module)
  * Version: 6.x, 7.x
  * Date: 2012-June-13
  * Security risk: Less critical [2]
  * Exploitable from: Remote
  * Vulnerability: Open Redirect

-------- DESCRIPTION  
---------------------------------------------------------

This module allows for authentication through the cloud user-management
platform Janrain Capture. Part of the module exposes an endpoint to
re-synchronize user data between Drupal and Capture and allows for passing an
optional parameter to redirect the user back to an original location. This
parameter was not checked to verify that it's an internal path, possibly
leading to an open redirect vulnerability if the user was tricked into
accessing the authentication workflow via a specially crafted URL.

An additional security weakness occurs when the module creates a new local
user account. The input to the generated password should be unguessable, but
could be partially discovered. For sites that allow both local and Capture
logins, this could lead to easy brute-force guessing of the local password.

CVE: Requested

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Janrain Capture 6.x-1.0
  * Janrain Capture 7.x-1.0

Drupal core is not affected. If you do not use the contributed Janrain
Capture [3] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the Janrain Capture module for Drupal 6.x, upgrade to Janrain
    Capture 6.x-1.1 [4] or later
  * If you use the Janrain Capture module for Drupal 7.x, upgrade to Janrain
    Capture 7.x-1.1 [5] or later

If you are using this module and allow local logins, you may wish to
regenerate the "random" local user passwords.

Also see the Janrain Capture [6] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Peter Wolanin [7] of the Drupal Security Team

-------- FIXED BY  
------------------------------------------------------------

  * Bryce Hamrick [8] the module maintainer

-------- COORDINATED BY  
------------------------------------------------------

  * Peter Wolanin [9] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [10].

Learn more about the Drupal Security team and their policies [11], writing
secure code for Drupal [12], and securing your site [13].


[1] http://drupal.org/project/janrain_capture
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/janrain_capture
[4] http://drupal.org/node/1632704
[5] http://drupal.org/node/1632702
[6] http://drupal.org/project/janrain_capture
[7] http://drupal.org/user/49851
[8] http://drupal.org/user/1350078
[9] http://drupal.org/user/49851
[10] http://drupal.org/contact
[11] http://drupal.org/security-team
[12] http://drupal.org/writing-secure-code
[13] http://drupal.org/security/secure-configuration

_______________________________________________
Security-news mailing list
Security-news@drupal.org
Unsubscribe at http://lists.drupal.org/mailman/listinfo/security-news

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|参考资料

来源:XF
名称:janrain-drupal-spoofing(76292)
链接:http://xforce.iss.net/xforce/xfdb/76292
来源:BID
名称:53992
链接:http://www.securityfocus.com/bid/53992
来源:OSVDB
名称:82958
链接:http://www.osvdb.org/82958
来源:MLIST
名称:[oss-security]20120613Re:CVERequestforDrupalcontributedmodules
链接:http://www.openwall.com/lists/oss-security/2012/06/14/3
来源:SECUNIA
名称:49480
链接:http://secunia.com/advisories/49480
来源:drupal.org
链接:http://drupal.org/node/1632734
来源:drupal.org
链接:http://drupal.org/node/1632704
来源:drupal.org
链接:http://drupal.org/node/1632702