CVE-2024-13266
📋 TL;DR
This CVE describes an incorrect authorization vulnerability in Drupal's Responsive and off-canvas menu module that allows forceful browsing (accessing restricted content without proper permissions). It affects Drupal sites using this contributed module. Attackers can bypass intended access controls to view content they shouldn't have permission to access.
💻 Affected Systems
- Drupal Responsive and off-canvas menu module
📦 What is this software?
Responsive And Off Canvas Menu by Responsive And Off Canvas Menu Project
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users gain access to sensitive administrative interfaces or confidential content, potentially leading to data exposure or privilege escalation.
Likely Case
Attackers access restricted content pages or functionality they shouldn't have permission to view, compromising data confidentiality.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized viewing of some restricted content.
🎯 Exploit Status
Exploitation requires some knowledge of the site structure but is technically simple once identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.4
Vendor Advisory: https://www.drupal.org/sa-contrib-2024-030
Restart Required: No
Instructions:
1. Update the Responsive and off-canvas menu module to version 4.4.4 or later. 2. Clear Drupal caches. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable the module
allTemporarily disable the vulnerable module until patching is possible
drush pm-disable responsive_off_canvas_menu
Implement additional access controls
allAdd custom access checks to affected routes
🧯 If You Can't Patch
- Implement web application firewall rules to block suspicious access patterns
- Increase logging and monitoring for unauthorized access attempts to restricted content
🔍 How to Verify
Check if Vulnerable:
Check if the Responsive and off-canvas menu module is installed and if its version is below 4.4.4Check Version:
drush pm-list | grep responsive_off_canvas_menuVerify Fix Applied:
Confirm module version is 4.4.4 or higher and test that restricted content cannot be accessed without proper permissions📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to restricted content paths
- 403 errors followed by successful 200 responses to same paths
Network Indicators:
- Repeated requests to admin or restricted URLs from unauthenticated or low-privilege users
SIEM Query:
source="drupal_access_log" AND (status=200 AND uri CONTAINS "/admin" OR uri CONTAINS "/restricted") AND user_role="anonymous"