SA-CONTRIB-2013-051 - Services - Cross site request forgery (CSRF)

This module enables you to expose an API to third party systems using REST, XML-RPC or other protocols.

The module doesn’t sufficiently verify writing requests (POST, PUT, DELETE) with session cookie authentication, thereby exposing a Cross Site Request Forgery vulnerability.

This vulnerability is mitigated by the fact that session based authentication must be enabled for an endpoint.

CVE identifier(s) issued

• CVE-2013-2158

Versions affected

• Services 6.x-3.x versions.
• Services 7.x-3.x versions prior to 7.x-3.4.

Drupal core is not affected. If you do not use the contributed Services module, there is nothing you need to do.

Solution

Install the latest version or uninstall the module.

• If you use the Services module for Drupal 7.x, upgrade to Services 7.x-3.4
• If you use the Services module for Drupal 6.x, uninstall the module.

Note that Services clients using session authentication now should supply a special X-CSRF-Token header with a token that can be retrieved from <http://example.com/services/session/token&gt;. This is needed for writing HTTP methods calls (POST, PUT, DELETE).

Also see the Services project page.

Reported by

• Klaus Purer of the Drupal Security Team
• Fredrik Lassen

Fixed by

• Yuriy Gerasimov the module maintainer

Coordinated by

• Klaus Purer of the Drupal Security Team