CVE-2024-13279
📋 TL;DR
A session fixation vulnerability in Drupal's Two-factor Authentication (TFA) module allows attackers to hijack user sessions by fixing session IDs before authentication. This affects all Drupal sites using the TFA module, potentially compromising any user accounts with TFA enabled. The vulnerability exists in all versions before 1.8.0.
💻 Affected Systems
- Drupal Two-factor Authentication (TFA) module
📦 What is this software?
Two Factor Authentication by Two Factor Authentication Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers can bypass two-factor authentication entirely, gaining unauthorized access to administrative accounts and complete site compromise.
Likely Case
Attackers hijack user sessions to access sensitive data, modify content, or perform unauthorized actions within the application.
If Mitigated
With proper network segmentation and monitoring, impact is limited to the affected Drupal instance only.
🎯 Exploit Status
Exploitation requires the attacker to have some initial access to fix the session ID before the victim authenticates.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.0
Vendor Advisory: https://www.drupal.org/sa-contrib-2024-043
Restart Required: No
Instructions:
1. Update the TFA module to version 1.8.0 via Drupal's update manager or Composer. 2. Clear Drupal caches. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable TFA Module
allTemporarily disable the vulnerable TFA module until patching is possible
drush pm:disable tfa
🧯 If You Can't Patch
- Implement network-level controls to restrict access to the Drupal admin interface
- Enable enhanced session monitoring and alerting for suspicious authentication patterns
🔍 How to Verify
Check if Vulnerable:
Check TFA module version in Drupal's Extend page or via drush: drush pm:list | grep tfaCheck Version:
drush pm:list --fields=name,version | grep tfaVerify Fix Applied:
Confirm TFA module version is 1.8.0 or higher📡 Detection & Monitoring
Log Indicators:
- Multiple session IDs for same user account
- Authentication from unusual locations after TFA setup
Network Indicators:
- Unusual authentication request patterns to /user/login and TFA endpoints
SIEM Query:
source="drupal" AND (event="session_start" OR event="user_login") | stats count by session_id, user