4

The Security advisories does not mention the usual classification for how critical this is (probably because it is about 3rd-party libraries). Can the whole site be compromised with this vulnerability or is it about accessing restricted content?

Ref.

https://www.drupal.org/SA-CORE-2018-005

https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers

  • 2
    In the Drupal security email about it, it was described as moderately critical. – Andy Aug 2 '18 at 8:45
  • 1
    Also "moderately critical" in their PSA: drupal.org/psa-2018-07-30 – MattLBeck Aug 2 '18 at 15:21
12

The specific vulnerability seems to be the ability of a requester to send one request path to the webserver, but use an HTTP header to make Drupal see a different path.

The rewrite happens early, so the access layer in Drupal/Symfony runs as intended. But it bypasses path-based restrictions that happen earlier ("on higher level caches and web servers", according to the CVE at https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers).

For example, if you use .htaccess to restrict /admin/* from outside your IP range, that might be bypassed, but Drupal's own access system will still work as it should.

2

At https://www.cybersecurity-help.cz/vdb/SB2018080118?affChecked=1 this vulnerability is described as low-risk. I haven't been able to find anything that describes in any detail how it can be exploited, though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.