SA-CONTRIB-2012-056 - Janrain Engage - Sensitive Data Protection Vulnerability

CVE: CVE-2012-2296

Using Janrain Engage, Drupal sites can authenticate new and existing users with popular social networks, map user profile data from these websites to Drupal fields, and share Drupal content with a user’s friends on their social networks.

The module permanently retains the complete user profile data returned from Engage in the users table. Only a subset of that data is needed for a limited time. The profile data is also stored in the sessions table. This is undesirable as it may include sensitive information (such as provider access tokens).

This is not an immediate vulnerability per se as it does not create an attack vector (i.e. it cannot be exploited) but it makes other weaknesses much more critical (e.g. a data breach could be parlayed into privilege escalation).

Versions affected

• Janrain Engage (formerly RPX) 6.x-1.x versions (all).
• Janrain Engage (formerly RPX) 6.x-2.x versions prior to 6.x-2.2.
• Janrain Engage (formerly RPX) 7.x-2.x versions prior to 7.x-2.2.

Drupal core is not affected. If you do not use the contributed Janrain Engage (formerly RPX) module, there is nothing you need to do.

Solution

Install the latest version:

• If you use Janrain Engage (formerly RPX) for Drupal 6.x, upgrade to version 6.x-2.2
• If you use Janrain Engage (formerly RPX) for Drupal 7.x, upgrade to version 7.x-2.2

Also see the Janrain Engage (formerly RPX) project page.

Reported by

• Peter Wolanin of the Drupal Security Team

Fixed by

• George Katsitadze the module maintainer

Coordinated by

• Peter Wolanin of the Drupal Security Team