====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN247
_____________________________________________________________________

DATE                : 07/09/2017

HARDWARE PLATFORM(S):  /

OPERATING SYSTEM(S): Systems running Clientside Validation versions 7.x
                          prior to 7.x-1.45, 7.x-2.0-beta1.

=====================================================================
https://www.drupal.org/node/2907118
____________________________________________________________________

Clientside Validation - Critical - Arbitary PHP Execution -
DRUPAL-SA-CONTRIB-2017-072


Posted by Drupal Security Team on 6 Sep 2017 at 17:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2017-072
Project: Clientside Validation (third-party module)
Version: 7.x
Date: 2017-September-06
Security risk:
16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Arbitrary PHP code execution


Description

The Clientside Validation module enables you to have clientside
(Javascript) validation on your forms.

The module does not sufficiently validate parameters of a POST request
made when validating a CAPTCHA.

For the 1.x version of this module, this vulnerability is mitigated by
the fact that the CAPTCHA module must be enabled and the 'validate
captcha' option of the Clientside Validation module must be enabled
(this option is enabled by default).

For the 2.x version of this module, this vulnerability is mitigated by
the fact that the CAPTCHA module must be enabled and the Clientside
Validation captcha submodule must be enabled.


CVE identifier(s) issued

A CVE identifier will be requested, and added upon issuance, in
accordance with Drupal Security Team processes.


Versions affected

Clientside Validation 7.x-1.x versions prior to 7.x-1.44.
Clientside Validation 7.x-2.x versions prior to 7.x-2.0-beta1.

Drupal core is not affected. If you do not use the contributed
Clientside Validation module, there is nothing you need to do.


Solution

Install the latest version:

If you use the 1.x version of Clientside Validation module for Drupal
7.x, upgrade to Clientside Validation 7.x-1.45
If you use the 2.x version of Clientside Validation module for Drupal
7.x, upgrade to Clientside Validation 7.x-2.0-beta2
Also see the Clientside Validation project page.


Reported by

Daniel-SCRT


Fixed by

Jelle Sebreghts the module maintainer


Coordinated by

Greg Knaddison of the Drupal Security Team


Contact and More Information

The Drupal security team can be reached at security at drupal.org or
via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing
secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity


⋅ Categories: Drupal 7.x

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================