CVE-2015-2749: Medium severity drupal vulnerability
Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
Other sources
The following flaw was found in Drupal:
Drupal core and contributed modules frequently use a "destination" query string parameter in URLs to redirect users to a new destination after completing an action on the current page. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.
In addition, several URL-related API functions in Drupal 6 and 7 can be tricked into passing through external URLs when not intending to, potentially leading to additional open redirect vulnerabilities.
This vulnerability is mitigated by the fact that many common uses of the "destination" parameter are not susceptible to the attack. However, all confirmation forms built using Drupal 7's form API are vulnerable via the Cancel action that appears at the bottom of the form, and some Drupal 6 confirmation forms are vulnerable too.
Upstream advisory:
https://www.drupal.org/SA-CORE-2015-001 https://www.drupal.org/node/2455007
Upstream patch:
http://cgit.drupalcode.org/drupal/commit/?id=d2304f840c43c190c6e136ee9901ed9797b4c3ca
CVE request pending:
http://seclists.org/oss-sec/2015/q1/893
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2749?
CVE-2015-2749 has a moderate severity rating as it allows attackers to conduct phishing attacks through open redirects.
How do I fix CVE-2015-2749?
To fix CVE-2015-2749, upgrade to Drupal versions 6.35 or 7.35 or later.
What software is affected by CVE-2015-2749?
CVE-2015-2749 affects Drupal versions prior to 6.35 and 7.35, including various earlier releases.
What types of attacks can be executed due to CVE-2015-2749?
CVE-2015-2749 can be exploited to redirect users to arbitrary web sites, making them vulnerable to phishing attacks.
Is there a workaround for CVE-2015-2749?
While upgrading is recommended, disabling user-input for redirect URLs can serve as a temporary workaround for CVE-2015-2749.