GHSA-x2rp-9qf7-2fmq: Infoleak
ModuleSearch decides whether to filter protected pages out of search results based on the current value of contao.search.indexprotected, but the authorisation data lives per row in tlsearch. Turning the setting off removes the filter without removing the rows, so protected pages that were indexed while it was on are returned to unauthenticated visitors such as title, URL and context snippet, even though the pages themselves still answer 401.
Impact
Disclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass.
Credits
This security vulnerability was found by @iRevivalx .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/contao/core-bundleto a version that resolves this vulnerability.Fixed in 5.7.12 - Upgrade
Upgrade
composer/contao/core-bundleto a version that resolves this vulnerability.Fixed in 5.3.50
Event History
Frequently Asked Questions
Which sites are exposed to this disclosure?
Sites are exposed when protected pages were indexed in tl_search while contao.search.index_protected was enabled and that setting is later disabled. In that state, unauthenticated users can receive those existing indexed entries in search results.
What can an unauthenticated visitor obtain?
They can obtain member-only page titles, URLs, and indexed context snippets through site search. The underlying protected pages remain access-controlled and return 401, so this does not bypass page access controls.
What can be done before updating?
Do not disable contao.search.index_protected if protected-page search entries may already exist. Enabling the setting causes ModuleSearch to filter protected pages from search results.
How can an administrator check for exposure?
Perform searches as an unauthenticated visitor and review results for titles, URLs, or snippets from protected pages. The relevant residual records are stored in tl_search.