DRD Agent - Critical - Multiple vulnerabilites

* Advisory ID: DRUPAL-SA-CONTRIB-2017-047
* Project: DRD agent (third-party module)
* Version: 6.x, 7.x, 8.x
* Date: 2017-May-10
* Security risk: 19/25 ( Critical)
* Vulnerability: Cross Site Request Forgery, Open Redirect

DESCRIPTION

The Drupal Remote Dashboard (DRD) module enables you to manage and monitor
any remote Drupal site and, this module, the DRD Agent is the remote module
which responds to requests from authorised DRD sites.

The module doesn't sufficiently protect the URL used to configure itself from
CSRF attacks, which could allow a malicious user to craft a special URL that
would reconfigure the DRD Agent and redirect to any URL if visited by an
admin user.

VERSIONS AFFECTED

* DRD Agent 7.x-3.x versions prior to 7.x-3.1.
* DRD Agent 8.x-3.x versions prior to 8.x-3.1.

Drupal core is not affected. If you do not use the contributed DRD agent
module, there is nothing you need to do.

SOLUTION

Install the latest version:

* If you use the DRD Agent module for Drupal 7.x, upgrade to DRD Agent
7.x-3.1
* If you use the DRD Agent module for Drupal 8.x, upgrade to DRD Agent
8.x-3.1

Also see the DRD agent project page: https://www.drupal.org/project/drd_agent

Add new comment