CVE-2017-6930

Vulnerability

In Drupal versions 8.4.x before 8.4.5, when using node access controls with a multilingual site, Drupal incorrectly marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. The vulnerability is mitigated by the fact that it only applies to sites that use the Content Translation module and a node access module such as Domain Access which implements hook_node_access_records() [1][2].

Exploitation

An attacker must have access to a multilingual Drupal site that uses the Content Translation module and a node access module (e.g., Domain Access). The attacker can exploit the bug by targeting nodes that have not been fully translated into a particular language. The system will fall back to the untranslated version, bypassing node access restrictions that were intended for that language. No authentication or special privileges are required beyond the ability to view nodes on the site [2][3].

Impact

Successful exploitation allows an attacker to view restricted content (information disclosure) that they should not have access to. The attacker may also be able to interact with content in ways normally prohibited by node access controls. The impact is limited to sites meeting the specific configuration prerequisites [2][3].

Mitigation

Drupal 8.4.5, released on 2018-03-01, fixes this vulnerability. Users should upgrade to version 8.4.5 or later. There is no known workaround for sites that cannot immediately upgrade. The issue does not affect Drupal 7 [2][4].