Drupal Services Module 'node.save' Security Bypass Vulnerability

Bugtraq ID:	45149
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 02 2010 12:00AM
Updated:	Jan 05 2011 08:42PM
Credit:	Yonathan Offek
Vulnerable:	Drupal Services Module 6.X-2.2
Not Vulnerable:	Drupal Services Module 6.X-2.3

Drupal Services Module 'node.save' Security Bypass Vulnerability

The Services module for Drupal is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass access control checks and modify nodes that would otherwise be restricted; this may aid in launching further attacks.

Versions prior to Services 6.x-2.3 are vulnerable.

Drupal Services Module 'node.save' Security Bypass Vulnerability

Attackers can exploit this issue using a browser or readily available tools.

Drupal Services Module 'node.save' Security Bypass Vulnerability

Solution:
Updates are available; please see the references for more information.

Drupal Services Module 'node.save' Security Bypass Vulnerability

References:

• Drupal Homepage (Drupal)
  
• SA-CONTRIB-2010-107 - Services - Access bypass (Drupal)
  
• Services Homepage (Drupal)