drupal_module-datafield-access-bypass.yaml

id: drupal_module-datafield-access-bypass
info:
  name: drupal_module-datafield-access-bypass
  author: Bishopfox
  severity: medium
  description: "The Data Field module provides a way of building field types that are made up of other fields, a simpler alternative to e.g. the Paragraphs system. Access to these forms isnt properly validated, allowing a user with the access content permission to view and edit fields on entities."
  reference:
    - https://www.drupal.org/sa-contrib-2023-040
  metadata:
    security-risk: "Moderately critical 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon"
    vulnerability: "access-bypass"
    fofa-query: "/sites/all/modules/datafield/"
    google-query: "inurl:'/sites/all/modules/datafield/"
    impact: medium
    type: indicator
    created_at: '0001-01-01T00:00:00Z'
  tags: drupal

http:
  - method: GET
    redirects: true
    max-redirects: 3
    path:
      - "{{BaseURL}}/sites/all/modules/datafield/datafield.info"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'version = "([0-9]+\.x-[0-9]+\.[0-9]+)"'
      - type: status
        status:
          - 200
      - type: word
        words:
          - 'datafield'
        part: body

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - 'version = "([0-9]+\.x-[0-9]+\.[0-9]+)"'

      - type: dsl
        dsl:
         - compare_versions(version, '1.0.15')
         - compare_versions(version, '1.0.14')
         - compare_versions(version, '1.0.13')
         - compare_versions(version, '1.0.12')
         - compare_versions(version, '1.0.11')
         - compare_versions(version, '1.0.10')
         - compare_versions(version, '1.0.9')
         - compare_versions(version, '1.0.8')
         - compare_versions(version, '1.0.7')
         - compare_versions(version, '1.0.6')
         - compare_versions(version, '1.0.5')
         - compare_versions(version, '1.0.4')
         - compare_versions(version, '1.0.3')
         - compare_versions(version, '1.0.2')
         - compare_versions(version, '1.0.1')
         - compare_versions(version, '1.0.0')