CVE-2024-13302
📋 TL;DR
This CVE describes an incorrect authorization vulnerability in Drupal's Pages Restriction Access module that allows attackers to bypass access controls through forceful browsing. It affects Drupal sites using the Pages Restriction Access module from version 2.0.0 through 2.0.2. Attackers can potentially access restricted pages they shouldn't have permission to view.
💻 Affected Systems
- Drupal Pages Restriction Access module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to sensitive administrative pages, confidential content, or user data that should be restricted.
Likely Case
Unauthorized users access moderately sensitive content pages that should be restricted to specific roles or users.
If Mitigated
Limited exposure if only non-sensitive pages are protected by the module or if additional access controls are in place.
🎯 Exploit Status
Exploitation requires some knowledge of the site structure but is technically simple once identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.3
Vendor Advisory: https://www.drupal.org/sa-contrib-2024-068
Restart Required: No
Instructions:
1. Update the Pages Restriction Access module to version 2.0.3 or later via Drupal's update manager. 2. Clear Drupal caches after update. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable Pages Restriction Access Module
allTemporarily disable the vulnerable module until patched
drush pm:disable pages_restriction_access
Implement Additional Access Controls
allAdd Drupal permissions or custom access checks to protected pages
🧯 If You Can't Patch
- Implement web application firewall rules to block access patterns indicative of forceful browsing
- Monitor access logs for unauthorized attempts to access restricted page URLs
🔍 How to Verify
Check if Vulnerable:
Check if Pages Restriction Access module is installed and version is between 2.0.0 and 2.0.2Check Version:
drush pm:list | grep pages_restriction_accessVerify Fix Applied:
Verify module version is 2.0.3 or later and test access to previously restricted pages📡 Detection & Monitoring
Log Indicators:
- Multiple 403 errors followed by successful 200 responses to same restricted URLs
- Unauthorized users accessing URLs with restricted patterns
Network Indicators:
- Repeated requests to known restricted page paths from unauthorized IPs
SIEM Query:
web_access_logs status_code=200 AND url_path CONTAINS '/restricted-page' AND user_role NOT IN ('admin','authorized_role')