Drupal oEmbed Module Security Bypass Vulnerability

Bugtraq ID:	45553
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 22 2010 12:00AM
Updated:	Dec 22 2010 12:00AM
Credit:	Benjamin Doherty
Vulnerable:	Drupal oEmbed 6.x-0.7
Not Vulnerable:	Drupal oEmbed 6.x-0.8

Drupal oEmbed Module Security Bypass Vulnerability

The oEmbed module for Drupal is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass security restrictions to obtain sensitive information or perform unauthorized actions; this may aid in launching further attacks.

Versions prior to oEmbed 6.x-0.8 are vulnerable.

Drupal oEmbed Module Security Bypass Vulnerability

Attackers can exploit this issue through a browser.

Drupal oEmbed Module Security Bypass Vulnerability

Solution:
The vendor has released fixes and an advisory. Please see the references for details.


Drupal oEmbed 6.x-0.7

• Drupal oembed-6.x-0.8.tar.gz
  http://drupal.org/node/998376

Drupal oEmbed Module Security Bypass Vulnerability

References:

• Drupal Homepage (Drupal)
  
• oEmbed Homepage (Drupal)
  
• SA-CONTRIB-2010-112 - oEmbed - Access Bypass (Drupal)