S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2022-057

Project: S3 File System
Date: 2022-September-28
Security risk: Moderately critical 10∕25
Vulnerability: Access bypass

Description

This module enables you to utilize S3-compatible storage as a Drupal filesystem.

The module doesn't sufficiently prevent file access across multiple filesystem schemes stored in the same bucket.

This vulnerability is mitigated by the fact that an attacker must obtain a method to access arbitrary file paths, the site must have public or private takeover enabled, and the file metadata cache must be ignored.

Solution

Install the latest version:

• If you use the S3 File System module for Drupal 7.x, upgrade to S3 File System 7.x-2.14