Security vulnerability in #Drupal contrib module puts 120000 sites at risk

http://drupal.sh/vulnerable-drupal-contrib-module-puts-120000-sites-at-risk

by velmu • 9 years ago

35 32 9 years ago

kyled3• 9 years ago

Looking at the source it took me < 5 minutes to find the actual vuln =/. Drupal saying "Just migrate away" is not the correct way to handle this disclosure. Some people can't switch immediately. A patch should be made available, and the module should be depreciated. Does Drupal have a way to update modules easily? If not, there should be...

YCode• 9 years ago

They probably don't want to get into the realm of maintaining user contributed modules.

They do offer an alternative (Entity Reference) and asked if anyone would patch or maintain the module. They also added a warning on the module's page.

kyled3• 9 years ago

Looks like someone is writing a patch already.

ketralnis• 9 years ago

Some people can't switch immediately. A patch should be made available, and the module should be depreciated

Maybe that's what should happen, but it's not what will happen.

The module is unmaintained. Who do you suggest should do it? Will you? If not then you're just demanding that work should be done somewhere, by someone else, without providing any path or resources for it. That's just not how freely contributed and shared labour works.

It's a risk you take on when you use that free resource, and why it matters to contribute back to the ecosystem that you're using free of charge. Frankly, if you've been using the freely available module for this long then you're already ahead of where you were before.

"This software is broken so you shouldn't use it" is absolutely a perfectly reasonable solution to the problem, and nobody owes you anything more.

kyled3• 9 years ago

The module is unmaintained. Who do you suggest should do it? Will you?

Yes. I am contacting the security team and working on a patch already. The page mentions someone is currently working on the issue already however.

"This software is broken so you shouldn't use it" is absolutely a perfectly reasonable solution.

I don't completely agree. If it's unmaintained, new installations shouldn't use it, totally agree. That doesn't help the 120K installations which are using the plugin though. It may take more time to impedance match apis, rather then fixing the security issue.

deanclatworthy• 9 years ago

Same. Took hardly any time to see the SQL injection. I wonder how many more of these there are on older installations using modules that are no longer actively maintained (Hint: probably lots. Code quality has come a long way since the early days of Drupal.)

phil21• 9 years ago

As someone who used to host many Drupal installs - all of them.

The joke around the ops/security team was Drupal is a remote shell with a bonus CMS attached to it.

AlbertQQA2• 9 years ago

Took hardly any time to see the SQL injection.

You sure you saw it correctly? Concatenation of hardcoded variants (poor-mans query builder) doesn't make an injection.

orf• 9 years ago

Drupal is known for it's large number of community contributed modules that add functionality to the bare bones core system.

No, it's known for its ridiculous number of security issues and sloppy code :/

ksenzee• 9 years ago

Drupal is easy to criticize, but its handling of security issues and its code quality aren't the two places I'd start. They're actually two of the strengths of the project.

jacquesm3• 9 years ago

You're missing a /s there.

devwastaken4• 9 years ago

This can be said of every CMS ever that isn't designed for very specific cases. Many would argue Wordpress is significantly worse and a massive mess. Atleast Drupal 8 tries to standardize and use good standards. If you know a better CMS out there, or any specific current problems with drupal 8, lets hear it.

mercer• 9 years ago

One reason why I prefer Wordpress is that I can pretty much build anything I want with just 'core' and a very small number of plugins (mostly Advanced Custom Fields, which has a paid version and quite actively developed).

With Drupal, on the other hand, I've always had to install a whole bunch of contrib modules just to get the basic functionality I needed. Has that changed significantly since Drupal 6 and 7?

Am I underestimating how insecure Wordpress core is, even considering that the get the equivalent you'd need Drupal plus a whole bunch of modules?

janwillemb• 9 years ago

Title is: Security vulnerability in unmaintained Drupal contrib module puts 120000 sites at risk

(Emphasis mine)

Security vulnerability in #Drupal contrib module puts 120000 sites at risk

Related Stories