Zwei Sicherheitsupdates gibt es in den Modulen Group und Hostmaster (Aegir) des CMS Drupal. Beide Lücken sind kritischen und können zur Übernahme des Webspaces führen.
Drupal Release Notes Modul Group
Version: 8.x-1.x-devDate: 2020-July-29
Security risk: Critical 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All
Vulnerability: Information Disclosure
This module enables you to hand out permissions on a smaller subset, section or community of your website.
The module used to leverage the node grants system but turned it off in its recent 8.x-1.0 release in favor of a system that works for ALL entity types, not just nodes. By doing so, some regular node access checks turned from neutral into allowed because of the way the node grants system operates.
This vulnerability is mitigated by the fact that the victim must have the GroupNode plugin installed on their website and have no other
hook_node_grants() implementations on their website aside from the one that was recently removed by Group. If you do not use the GroupNode plugin or still have
hook_node_grants() implementing modules enabled, your site may not be affected.Solution:
Install the latest version:
- If you are using 8.x-1.0-rc5 that version is not affected by this issue. You can also consider upgrading to 8.x-1.1
- If you are using 8.x-1.0 you should upgrade to 8.x-1.1
- Greg Knaddison Of the Drupal Security Team
Drupal Release Notes Modul Hostmaster (Aegir)
Project: Hostmaster (Aegir)
Security risk: Moderately critical 14∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon
Vulnerability: Access bypass, Arbitrary code execution
Aegir is a powerful hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites.
- Aegir can use both Apache and Nginx Web servers,
- Apache allows configuration-writing users to escalate their privileges to the superuser
- Aegir’s operations are performed by the GNU/Linux user
It follows that:
- Users with access to the
aegiraccount can escalate their privileges to
- Any PHP code submitted through the front-end Web UI via enabling modules (such as PHP, Views PHP, and Computed Field) could be run as root though a cron hook implementation. (Aegir runs cron through the
aegiruser via Drush.)
This vulnerability is mitigated by the fact that
- an attacker must have access to the
- the Web server must be Apache.
While it was generally assumed that
aegir access should only be provided to trusted users (i.e. users who also have access to
root), this wasn’t explicitly stated. The documentation has since been updated.Solution:
If you’re running Aegir and have granted untrusted users access to the
aegiraccount access for users who you would not trust with
- disable any module functionality on the hosted Drupal sites that allows PHP code to be entered on the front-end Web UI. Computed Field, for example, can still be used safely by providing code from the back-end only. (See Stop allowing PHP from being entered on the Web UI for a plan to enforce this.)
We do not recommend switching to an Nginx Web server instead of revoking access. This is because there could be as-yet-unknown privilege-escalation exploits involving Nginx (as with any other piece of software).
Switching to Nginx
While not recommended, if this is something you’d like to do in addition to making the above change, we can offer some information on how to do it.
While there may eventually be a migration path to convert existing Apache installations to Nginx, the recommended approach is currently:
- Set up a new Aegir installation using Nginx.
- Remotely import sites from the original Apache server.
- Decommission the original Apache server.
Also see the Hostmaster (Aegir) project page.Reported By:
- Heineof the Drupal Security Team
- Greg Knaddisonof the Drupal Security Team