SA-CONTRIB-2013-095 - Organic Groups - Access bypass

Two issues exist within entity references and permissions relating to OG, allowing users potential access bypass.

Posting content into groups where a user is not a member

Organic Groups does not sufficiently check the group audience fields (e.g. og_group_ref) field from being populated with invalid data. The autocomplete reference field only needs a node id to validate.

An attacker could modify a group audience field in order to post within a group they had no access.

Any user with the ability to create content can use this vulnerability.

Inconsistent access checking in posting content

Organic Groups manages its own group based permissions. This allows users to have escalated privileges sets in specific groups, but not site-wide. Organic Groups makes the assumption that the group field is populated and when this not populated, a user may have permission to create or edit content outside of a group even though they shouldn’t be allowed to do that.

This vulnerability is mitigated because the following must be true in order for it to work:

1. The node in question must have all of its groups be set as optional input
2. The user must not have site-wide access to post content of a certain type, but also a member of a group that does permit create/edit privileges to the same type.

CVE identifier(s) issued

• Posting content into groups where a user is not a member: CVE-2013-7065 * Inconsistent access checking in posting content:CVE-2013-7068

Versions affected

• OG 7.x-2.x versions prior to 7.x-2.3

Drupal core is not affected. If you do not use the contributed Organic groups module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Organic Groups module for Drupal 7.x, upgrade to og 7.x-2.4

Also see the Organic groups project page.

Reported by

• Jakob Perry
• Richard Goodrow
• Bruce Hoppe

Fixed by

• Amitai Burstein the module maintainer
• Roy Segall
• Jakob Perry

Coordinated by

• David Stoline of the Drupal Security Team