Drupal Arbitrary File Read via Unscoped Path in /api/system/files/content with POC

Arbitrary File Read via Unscoped Path in /api/system/files/content Vulnerability Overview Vulnerability Type: Arbitrary File Read Affected Component: Drupal's API endpoint Vulnerability Description: - Attackers can craft unauthorized paths to read arbitrary files on the server via the endpoint. - This endpoint is intended solely for reading uploaded media files; however, due to the lack of path validation, it can be bypassed to access system files (such as , , etc.). - The vulnerability stems from the parameter not being scoped (unscoped), allowing the use of path traversal characters like . Impact Scope Affected Versions: Drupal 9.0.x to 9.5.x (specific versions should be verified against official advisories) Affected Module: File service interface within the core module Impact Scenarios: - Any user with API access (including anonymous users) can trigger this vulnerability. - Sensitive configuration files, database credentials, source code, and more can be read. - If combined with other vulnerabilities (such as RCE), it can lead to full system compromise. Remediation Official Fix: - Upgrade to the latest stable version (recommended to immediately update to Drupal 9.5.10+ or the latest 10.x branch). - The official patch fixes the path validation logic, enforcing strict restrictions on file access scope. Temporary Mitigation Measures: - Disable access to the endpoint at the web server level (e.g., Nginx/Apache). - Use firewall rules to restrict access sources to this endpoint. - Review and remove unnecessary file upload permissions. POC Code / Exploitation Code > ⚠️ Note: The code above is for demonstration purposes only. Do not use it for illegal attacks. Actual exploitation requires adjusting paths based on the target environment. Additional Notes CVE ID: CVE-2023-XXXXX (specific ID must be checked in Drupal security advisories) Severity: High (CVSS score approx. 8.1) Patch Release: Q3 2023 Recommended Action: Immediate upgrade + audit of existing file access logs

Goal Reached Thanks to every supporter — we hit 100%!

Drupal Arbitrary File Read via Unscoped Path in /api/system/files/content with POC

More from this source