CVE-2025-31690
📋 TL;DR
This CSRF vulnerability in Drupal Cache Utility allows attackers to trick authenticated users into performing unintended actions on their behalf. It affects all Drupal sites using Cache Utility versions before 1.2.1. The vulnerability enables attackers to manipulate cache operations through forged requests.
💻 Affected Systems
- Drupal Cache Utility
📦 What is this software?
Cache Utility by Cache Utility Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate cache content, potentially poisoning cache with malicious data that affects all site visitors, leading to data integrity issues or content manipulation.
Likely Case
Attackers trick administrators into performing unauthorized cache operations, potentially clearing or modifying cache entries that could disrupt site functionality.
If Mitigated
With proper CSRF protections and user awareness, impact is limited to unsuccessful attack attempts with no actual cache manipulation.
🎯 Exploit Status
Requires social engineering to trick authenticated users into clicking malicious links or visiting compromised sites.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.1
Vendor Advisory: https://www.drupal.org/sa-contrib-2025-019
Restart Required: No
Instructions:
1. Update Cache Utility module to version 1.2.1 via Drupal's update manager. 2. Clear Drupal cache. 3. Verify module functionality.
🔧 Temporary Workarounds
CSRF Token Enforcement
allImplement custom CSRF token validation for Cache Utility operations
🧯 If You Can't Patch
- Disable Cache Utility module if not essential
- Implement web application firewall rules to detect CSRF patterns
🔍 How to Verify
Check if Vulnerable:
Check Cache Utility module version in Drupal admin at /admin/modules or via drush: drush pm-list | grep cache_utilityCheck Version:
drush pm-list --fields=name,version | grep cache_utilityVerify Fix Applied:
Confirm Cache Utility version is 1.2.1 or higher and test cache operations with CSRF tokens📡 Detection & Monitoring
Log Indicators:
- Multiple cache operation requests without referrer headers
- Cache operations from unexpected user agents or IPs
Network Indicators:
- POST requests to cache endpoints without CSRF tokens
- Cache operations originating from external domains
SIEM Query:
web_requests WHERE (uri CONTAINS '/cache' OR uri CONTAINS '/admin/config/development/performance') AND csrf_token IS NULL