Overview
Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications. The Access Control contributed module allows users to log in using an access code instead of entering a username and password.
The module contains a vulnerability in that it does not include flood control. With flood control missing (and no other protective measures in place), it is possible to determine an access code with a brute-force attack.
Broken Access Control occurs when an application fails to properly enforce restrictions on what authenticated users are allowed to do, enabling attackers to access unauthorized functionality, data, or resources. It often stems from inadequate validation of user permissions, allowing someone to bypass intended security boundaries and perform actions beyond their assigned role.
In this case, a brute force attack can allow a malicious user to enter the system.
Any of the following ramifications are possible:
- Allowing arbitrary code execution
- Complete system compromise
- Data theft or exposure
- Data manipulation or destruction
- Privilege escalation, and
- Denial of service.
Typically, exploits such as this are considered high-severity, However, this is rated as medium-severity because of the following mitigating factors:
- The module is not installed by default
- Login through the module can be turned off for sensitive accounts.
This issue affects all versions of Drupal 7 Access Control including and below 7.1.1; it is patched in Access Control NES version 7.1.2.
Details
Module Info
Product: Drupal
Affected modules: Access Control contributed module
Affected versions: <=7.1.1
Project page: https://www.drupal.org/project/access_code
Vulnerability Info
This medium-severity vulnerability is found in all versions of the Access Code module up to and including 7.1.1.
Addressing the Issue
Users of the affected component(s) should address this exploit in one of the following ways:
- Using a Web Application Firewall (WAF), configure rate limiting rules to restrict the number of access code attempts per IP address per time period; consider rate limiting modules for webservers, as well
- Disable access code logins for critical accounts
- Implement a CAPTCHA challenge on the form after a certain number of failed attempts
- Manually implement session-based attempt tracking in custom code
- Sign up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.
Credits
- Marcin Maruszewski (marcin maruszewski)
