CVE-2024-13250
📋 TL;DR
This Cross-Site Request Forgery (CSRF) vulnerability in Drupal Symfony Mailer Lite allows attackers to trick authenticated users into performing unintended actions on the Drupal site. It affects all Drupal installations using the Symfony Mailer Lite module from initial release through version 1.0.5.
💻 Affected Systems
- Drupal Symfony Mailer Lite
📦 What is this software?
Drupal Symfony Mailer Lite by Drupal Symfony Mailer Lite Project
⚠️ Risk & Real-World Impact
Worst Case
An attacker could trick an administrator into changing system configurations, creating new admin accounts, or modifying content permissions, potentially leading to complete site compromise.
Likely Case
Attackers could manipulate authenticated users to change their own settings, submit forms, or perform actions within their permission scope without their knowledge.
If Mitigated
With proper CSRF protections enabled, the vulnerability would be blocked, preventing unauthorized state-changing requests.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into visiting malicious pages while logged into the Drupal site.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.6
Vendor Advisory: https://www.drupal.org/sa-contrib-2024-014
Restart Required: No
Instructions:
1. Update the Symfony Mailer Lite module to version 1.0.6 or later via Drupal's update manager. 2. Clear Drupal caches after update. 3. Verify the update was successful by checking the module version.
🔧 Temporary Workarounds
Disable Symfony Mailer Lite Module
allTemporarily disable the vulnerable module until patching is possible
drush pm:disable symfony_mailer_lite
🧯 If You Can't Patch
- Implement additional CSRF protection at the web application firewall level
- Disable the Symfony Mailer Lite module entirely
🔍 How to Verify
Check if Vulnerable:
Check if the Symfony Mailer Lite module is enabled and version is 1.0.5 or lower via Drupal admin interface or drush command: drush pm:list | grep symfony_mailer_liteCheck Version:
drush pm:list | grep symfony_mailer_liteVerify Fix Applied:
Verify module version is 1.0.6 or higher: drush pm:list | grep symfony_mailer_lite📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to Symfony Mailer Lite endpoints without CSRF tokens
- Multiple failed CSRF validation attempts
Network Indicators:
- Requests to Drupal endpoints with missing or invalid CSRF tokens from unexpected referrers
SIEM Query:
web_requests WHERE (uri CONTAINS 'symfony_mailer_lite' OR uri CONTAINS 'mailer') AND (csrf_token IS NULL OR csrf_token INVALID) AND method='POST'