CVE-2024-13258
📋 TL;DR
This vulnerability allows attackers to bypass authorization controls in Drupal's REST & JSON API Authentication module, enabling forceful browsing to access restricted resources. It affects all Drupal sites using this module from version 0.0.0 up to (but not including) 2.0.13.
💻 Affected Systems
- Drupal REST & JSON API Authentication module
📦 What is this software?
Rest \& Json Api Authentication by Rest \& Json Api Authentication Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to sensitive data, administrative functions, or user accounts, potentially leading to complete site compromise.
Likely Case
Unauthorized access to protected API endpoints, data exfiltration, or privilege escalation.
If Mitigated
Limited impact if proper network segmentation and additional authentication layers are in place.
🎯 Exploit Status
Exploitation requires sending crafted requests to vulnerable API endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.13
Vendor Advisory: https://www.drupal.org/sa-contrib-2024-022
Restart Required: No
Instructions:
1. Update the module via Drupal's admin interface or Composer. 2. Run database updates if required. 3. Clear all caches.
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the REST & JSON API Authentication module if immediate patching isn't possible.
drush pm:disable rest_api_authentication
Restrict API access
allUse web application firewall rules to restrict access to REST/JSON API endpoints.
🧯 If You Can't Patch
- Implement strict network access controls to limit API endpoint exposure
- Add additional authentication layers (API keys, IP whitelisting) for sensitive endpoints
🔍 How to Verify
Check if Vulnerable:
Check module version via Drupal admin at /admin/modules or using 'drush pm:list | grep rest_api_authentication'Check Version:
drush pm:list --fields=name,version | grep rest_api_authenticationVerify Fix Applied:
Confirm module version is 2.0.13 or higher and test authorization controls on protected endpoints📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to REST/JSON endpoints
- Unusual API request patterns from single sources
Network Indicators:
- Spike in requests to /jsonapi/* or /rest/* endpoints
- Requests bypassing expected authentication flows
SIEM Query:
source="drupal_access_log" AND (uri_path="/jsonapi/*" OR uri_path="/rest/*") AND status_code=200 AND user="anonymous"