SA-CONTRIB-2012-016 - Forward module CSRF and Access bypass

The Forward module enables you to add a “forward this page” link to each node. The link takes regular site visitors to a form where they can generate an email to a friend. The module exhibits multiple vulnerabilities as described below.

The module includes “Recent forwards” and “Most forwarded” blocks that display the titles of the most recently forwarded nodes and the nodes forwarded the most for all time. The module doesn’t check that site visitors have permissions to view the node titles listed in these blocks, resulting in an access bypass. This vulnerability is mitigated by the fact that these blocks are disabled by default.

The module includes a “Dynamic Block” feature which adds a listing of the top 5 node titles to the bottom of the generated email to a friend. The module doesn’t sufficiently check that the email recipient has permission to view the node titles included in the block, resulting in an access bypass. This vulnerability is mitigated by the fact that the Dynamic Block feature is disabled by default.

The module includes clickthrough tracking so that the site administrator can determine which emails are generating the most clicks back to the site. The tracking code is vulnerable to CSRF because it uses a publicly available link that could be manipulated to falsely boost the perceived importance of a node.

The CSRF issue is
CVE: CVE-2012-1057

The Access bypass issue is
CVE: CVE-2012-1056

Versions affected

• Forward 6.x-1.x versions prior to 6.x-1.21
• Forward 7.x-1.x versions prior to 7.x-1.3

Drupal core is not affected. If you do not use the contributed Forward module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Forward module for Drupal 6.x, upgrade to Forward 6.x-1.21
• If you use the Forward module for Drupal 7.x, upgrade to Forward 7.x-1.3

The upgrade is “code only” and does not require running the database update script.

IMPORTANT: Administrators of sites that rely on the Dynamic Block access bypass to operate correctly need to visit the Forward configuration page and explicitly select the Dynamic Block Access Control bypass option after upgrading. This should be rare, so most site administrators can simply upgrade the module without the need for additional configuration.

See also the Forward project page.

Reported by

• Greg Knaddison (greggles) of the Drupal Security Team

Fixed by

• John Oltman the module maintainer

Coordinated by

• Greg Knaddison (greggles) of the Drupal Security Team