====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN231
_____________________________________________________________________

DATE                : 17/08/2017

HARDWARE PLATFORM(S):  /

OPERATING SYSTEM(S): Systems running Drupal Core versions 8.x prior to
                                       8.3.7.

=====================================================================
https://www.drupal.org/SA-CORE-2017-004
____________________________________________________________________

Drupal Core - Multiple Vulnerabilities - SA-CORE-2017-004
Posted by Drupal Security Team on 16 Aug 2017 at 16:38 UTC

Drupal 8.3.7 is a maintenance releases which contain fixes for security
vulnerabilities.


Updating your existing Drupal 8 sites is strongly recommended (see
instructions for Drupal 8). This release fixes security issues only;
there are no new features nor non-security-related bug fixes in this
release. See the 8.3.7 release notes for details on important changes
and known issues affecting this release. Read on for details of the
security vulnerabilities that were fixed in this release.

    Advisory ID: DRUPAL-SA-CORE-2017-004
    Project: Drupal core
    Version: 8.x
    Date: 2017-Aug-16
    Security risk: 15/25 ( Critical)
              AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
    Multiple vulnerabilities


Description

Views - Access Bypass - Moderately Critical - Drupal 8 - CVE-2017-6923

When creating a view, you can optionally use Ajax to update the
displayed data via filter parameters. The views subsystem/module did
not restrict access to the Ajax endpoint to only views configured to
use Ajax. This is mitigated if you have access restrictions on the view.

It is best practice to always include some form of access restrictions
on all views, even if you are using another module to display them.


REST API can bypass comment approval - Access Bypass - Moderately
Critical - Drupal 8 - CVE-2017-6924

When using the REST API, users without the correct permission can post
comments via REST that are approved even if the user does not have
permission to post approved comments.

This issue only affects sites that have the RESTful Web Services (rest)
module enabled, the comment entity REST resource enabled, and where an
attacker can access a user account on the site with permissions to post
comments, or where anonymous users can post comments.


Entity access bypass for entities that do not have UUIDs or have
protected revisions - Access Bypass - Critical - Drupal 8 -
CVE-2017-6925

There is a vulnerability in the entity access system that could allow
unwanted access to view, create, update, or delete entities. This only
affects entities that do not use or do not have UUIDs, and entities
that have different access restrictions on different revisions of the
same entity.

Versions affected

    Drupal core 8.x versions prior to 8.3.7

Solution

Install the latest version:

    If you use Drupal 8.x, upgrade to Drupal core 8.3.7

Drupal 7 core is not affected, however, Drupal 7 Views is: see Views -
Moderately Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-068


Also see the Drupal core project page.


Reported by

Views - Access Bypass

    Maxim Podorov

REST API can bypass comment approval - Access Bypass

    Arshad

Entity access bypass for entities that do not have UUIDs or
protected revisions - Access Bypass

    Miles Worthington


Fixed by

Views - Access Bypass

    Klaus Purer
    Daniel Wehner
    Michael Hess of the Drupal Security Team
    Len Swaneveld
    Wim Leers

REST API can bypass comment approval - Access Bypass

    Daniel Wehner
    Arshad
    Lee Rowlands of the Drupal Security Team
    Wim Leers
    Sascha Grossenbacher

Entity access bypass for entities that do not have UUIDs or
protected revisions - Access Bypass

    Andrei Mateescu
    Peter Wolanin of the Drupal Security Team
    Matthew Donadio
    xjm of the Drupal Security Team
    Sascha Grossenbacher


Contact and More Information

The Drupal security team can be reached at security at drupal.org or
via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing
secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================