ID CVE-2017-6919
Summary Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
References
Vulnerable Configurations
  • Drupal 8.3.0 Release Candidate 1
    cpe:2.3:a:drupal:drupal:8.3.0:rc1
  • Drupal 8.3.0 Release Candidate 2
    cpe:2.3:a:drupal:drupal:8.3.0:rc2
  • Drupal 8.3.0 Beta 1
    cpe:2.3:a:drupal:drupal:8.3.0:beta1
  • Drupal 8.3.0 Alpha 1
    cpe:2.3:a:drupal:drupal:8.3.0:alpha1
  • Drupal 8.3.0
    cpe:2.3:a:drupal:drupal:8.3.0
  • Drupal 8.0.0
    cpe:2.3:a:drupal:drupal:8.0.0
  • Drupal 8.0.0 Alpha 10
    cpe:2.3:a:drupal:drupal:8.0.0:alpha10
  • Drupal 8.0.0 Alpha 11
    cpe:2.3:a:drupal:drupal:8.0.0:alpha11
  • Drupal 8.0.0 Alpha 12
    cpe:2.3:a:drupal:drupal:8.0.0:alpha12
  • Drupal 8.0.0 Alpha 13
    cpe:2.3:a:drupal:drupal:8.0.0:alpha13
  • Drupal 8.0.0 Alpha 14
    cpe:2.3:a:drupal:drupal:8.0.0:alpha14
  • Drupal 8.0.0 Alpha 15
    cpe:2.3:a:drupal:drupal:8.0.0:alpha15
  • Drupal 8.0.0 Alpha 2
    cpe:2.3:a:drupal:drupal:8.0.0:alpha2
  • Drupal 8.0.0 Alpha 3
    cpe:2.3:a:drupal:drupal:8.0.0:alpha3
  • Drupal 8.0.0 Alpha 4
    cpe:2.3:a:drupal:drupal:8.0.0:alpha4
  • Drupal 8.0.0 Alpha 5
    cpe:2.3:a:drupal:drupal:8.0.0:alpha5
  • Drupal 8.0.0 Alpha 6
    cpe:2.3:a:drupal:drupal:8.0.0:alpha6
  • Drupal 8.0.0 Alpha 7
    cpe:2.3:a:drupal:drupal:8.0.0:alpha7
  • Drupal 8.0.0 Alpha 8
    cpe:2.3:a:drupal:drupal:8.0.0:alpha8
  • Drupal 8.0.0 Alpha 9
    cpe:2.3:a:drupal:drupal:8.0.0:alpha9
  • Drupal 8.0.0 Beta 1
    cpe:2.3:a:drupal:drupal:8.0.0:beta1
  • Drupal 8.0.0 Beta 10
    cpe:2.3:a:drupal:drupal:8.0.0:beta10
  • Drupal 8.0.0 Beta 11
    cpe:2.3:a:drupal:drupal:8.0.0:beta11
  • Drupal 8.0.0 Beta 12
    cpe:2.3:a:drupal:drupal:8.0.0:beta12
  • Drupal 8.0.0 Beta 13
    cpe:2.3:a:drupal:drupal:8.0.0:beta13
  • Drupal 8.0.0 Beta 14
    cpe:2.3:a:drupal:drupal:8.0.0:beta14
  • Drupal 8.0.0 Beta 15
    cpe:2.3:a:drupal:drupal:8.0.0:beta15
  • Drupal 8.0.0 Beta 16
    cpe:2.3:a:drupal:drupal:8.0.0:beta16
  • Drupal 8.0.0 Beta 2
    cpe:2.3:a:drupal:drupal:8.0.0:beta2
  • Drupal 8.0.0 Beta 3
    cpe:2.3:a:drupal:drupal:8.0.0:beta3
  • Drupal 8.0.0 Beta 4
    cpe:2.3:a:drupal:drupal:8.0.0:beta4
  • Drupal 8.0.0 Beta 6
    cpe:2.3:a:drupal:drupal:8.0.0:beta6
  • Drupal 8.0.0 Beta 7
    cpe:2.3:a:drupal:drupal:8.0.0:beta7
  • Drupal 8.0.0 Beta 9
    cpe:2.3:a:drupal:drupal:8.0.0:beta9
  • Drupal 8.0.0 Release Candidate 1
    cpe:2.3:a:drupal:drupal:8.0.0:rc1
  • Drupal 8.0.0 Release Candidate 2
    cpe:2.3:a:drupal:drupal:8.0.0:rc2
  • Drupal 8.0.0 Release Candidate 3
    cpe:2.3:a:drupal:drupal:8.0.0:rc3
  • Drupal 8.0.0 Release Candidate 4
    cpe:2.3:a:drupal:drupal:8.0.0:rc4
  • Drupal 8.0.1
    cpe:2.3:a:drupal:drupal:8.0.1
  • Drupal 8.0.2
    cpe:2.3:a:drupal:drupal:8.0.2
  • Drupal 8.0.3
    cpe:2.3:a:drupal:drupal:8.0.3
  • Drupal 8.0.4
    cpe:2.3:a:drupal:drupal:8.0.4
  • Drupal 8.0.5
    cpe:2.3:a:drupal:drupal:8.0.5
  • Drupal 8.0.6
    cpe:2.3:a:drupal:drupal:8.0.6
  • Drupal 8.1.0
    cpe:2.3:a:drupal:drupal:8.1.0
  • Drupal 8.1.0 Beta 1
    cpe:2.3:a:drupal:drupal:8.1.0:beta1
  • Drupal 8.1.0 Beta 2
    cpe:2.3:a:drupal:drupal:8.1.0:beta2
  • Drupal 8.1.0 Release Candidate 1
    cpe:2.3:a:drupal:drupal:8.1.0:rc1
  • Drupal 8.1.1
    cpe:2.3:a:drupal:drupal:8.1.1
  • Drupal 8.1.2
    cpe:2.3:a:drupal:drupal:8.1.2
  • Drupal 8.1.3
    cpe:2.3:a:drupal:drupal:8.1.3
  • Drupal 8.1.4
    cpe:2.3:a:drupal:drupal:8.1.4
  • Drupal 8.1.5
    cpe:2.3:a:drupal:drupal:8.1.5
  • Drupal 8.1.6
    cpe:2.3:a:drupal:drupal:8.1.6
  • Drupal 8.1.7
    cpe:2.3:a:drupal:drupal:8.1.7
  • Drupal 8.1.8
    cpe:2.3:a:drupal:drupal:8.1.8
  • Drupal 8.1.9
    cpe:2.3:a:drupal:drupal:8.1.9
  • Drupal 8.1.10
    cpe:2.3:a:drupal:drupal:8.1.10
  • Drupal 8.2.7
    cpe:2.3:a:drupal:drupal:8.2.7
  • Drupal 8.2.0
    cpe:2.3:a:drupal:drupal:8.2.0
  • Drupal 8.2.0 Beta 1
    cpe:2.3:a:drupal:drupal:8.2.0:beta1
  • Drupal 8.2.0 Beta 2
    cpe:2.3:a:drupal:drupal:8.2.0:beta2
  • Drupal 8.2.0 Beta 3
    cpe:2.3:a:drupal:drupal:8.2.0:beta3
  • Drupal 8.2.0 Release Candidate 1
    cpe:2.3:a:drupal:drupal:8.2.0:rc1
  • Drupal 8.2.0 Release Candidate 2
    cpe:2.3:a:drupal:drupal:8.2.0:rc2
  • Drupal 8.2.1
    cpe:2.3:a:drupal:drupal:8.2.1
  • Drupal 8.2.2
    cpe:2.3:a:drupal:drupal:8.2.2
  • Drupal 8.2.3
    cpe:2.3:a:drupal:drupal:8.2.3
  • Drupal 8.2.4
    cpe:2.3:a:drupal:drupal:8.2.4
  • Drupal 8.2.5
    cpe:2.3:a:drupal:drupal:8.2.5
  • Drupal 8.2.6
    cpe:2.3:a:drupal:drupal:8.2.6
CVSS
Base: 6.0 (as of 24-04-2017 - 19:56)
Impact:
Exploitability:
CWE CWE-284
CAPEC
  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Signature Spoofing by Key Theft
    An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-CCDF272E60.NASL
    description - [8.3.1](https://www.drupal.org/project/drupal/releases/8 .3.1) - [Drupal Core - Critical - Access Bypass - SA-CORE-2017-002](https://www.drupal.org/SA-CORE-2017-00 2) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 101720
    published 2017-07-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101720
    title Fedora 26 : drupal8 (2017-ccdf272e60)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_1455C86C26C211E79DAA6CF0497DB129.NASL
    description Drupal Security Team Reports : CVE-2017-6919: Access bypass
    last seen 2018-11-13
    modified 2018-11-10
    plugin id 99615
    published 2017-04-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99615
    title FreeBSD : drupal8 -- Drupal Core - Critical - Access Bypass (1455c86c-26c2-11e7-9daa-6cf0497db129)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-041473E742.NASL
    description - [8.3.1](https://www.drupal.org/project/drupal/releases/8 .3.1) - [Drupal Core - Critical - Access Bypass - SA-CORE-2017-002](https://www.drupal.org/SA-CORE-2017-00 2) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 99922
    published 2017-05-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99922
    title Fedora 25 : drupal8 (2017-041473e742)
  • NASL family CGI abuses
    NASL id DRUPAL_8_2_8.NASL
    description According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.2.8 or 8.3.x prior to 8.3.1. It is, therefore, affected by an access bypass vulnerability due to an unspecified flaw when the RESTful Web Services (rest) module is enabled and the site allows PATCH requests. An authenticated, remote attacker can exploit this to bypass critical access restrictions. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-06-14
    plugin id 99690
    published 2017-04-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99690
    title Drupal 8.x < 8.2.8 / 8.3.x < 8.3.1 Access Bypass Vulnerability (SA-CORE-2017-002)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-E8767A2FBB.NASL
    description - [8.3.1](https://www.drupal.org/project/drupal/releases/8 .3.1) - [Drupal Core - Critical - Access Bypass - SA-CORE-2017-002](https://www.drupal.org/SA-CORE-2017-00 2) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 99925
    published 2017-05-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99925
    title Fedora 24 : drupal8 (2017-e8767a2fbb)
refmap via4
bid 97941
confirm https://www.drupal.org/SA-CORE-2017-002
sectrack 1038371
Last major update 24-04-2017 - 20:41
Published 19-04-2017 - 22:59
Last modified 10-07-2017 - 21:33
Back to Top