Drupal Commerce Core Access Bypass Exploited; No CVE Assigned

En bref

• A permission-bypass weakness affects Drupal's Commerce Core add-on.
• Live attacks are underway by unidentified actors; no CVE ID has been published.
• Drupal site owners should update the add-on and inspect logs for abuse.
• Delayed remediation leaves commerce-enabled sites exposed to unauthorized access.

Drupal's Commerce Core add-on contains a flaw that can let users get around permission checks, and that weakness is now being used in live attacks. No CVE identifier has been issued for the issue, and the actors behind the exploitation have not been identified. Administrators running the add-on are being urged to apply the vendor's fix promptly rather than waiting for a CVE record or broader public reporting.

The exposure applies to Drupal sites that rely on Commerce Core, particularly installations using the add-on for catalog, checkout, or other commerce-related workflows. A permission bypass can allow requests to reach restricted pages, operations, or data that should normally require specific roles. Because the add-on sits alongside Drupal core, patching Drupal itself is not enough; the Commerce Core component must be updated or mitigated separately.

Active exploitation raises the risk even without a CVE. Many vulnerability scanners and tracking tools key off CVE identifiers, so an unassigned flaw can slip past routine reporting while attacks are already underway. Public-sector and education sites that use Drupal for paid services, registrations, or other commerce functions should treat this as a priority, especially where the module is internet-facing.

Contributed Drupal modules are maintained separately from core, and Commerce Core is widely deployed. Attackers often move quickly against known weaknesses in add-ons because they can reach many sites through a common component. The absence of a CVE does not mean the issue is low risk; it means defenders should rely on the vendor advisory and direct module inventory rather than scanner coverage alone.

Watch for unusual requests to commerce-related paths, unexpected access to restricted operations, permission changes, and anomalies in order or checkout activity. Confirm which sites run Commerce Core, record the installed version, apply the update, and keep monitoring after patching. If an immediate update is not possible, restrict access to affected endpoints and consider virtual patching until remediation is complete.

À faire maintenant

1. Inventory every Drupal instance and confirm which sites have Commerce Core installed, prioritizing internet-facing commerce deployments.
2. Apply the vendor's update for Commerce Core immediately; if no patch is available, disable the add-on or restrict access to affected routes.
3. Review Drupal, web server, and application logs for unusual requests to commerce endpoints, permission-bypass indicators, and unauthorized access to restricted operations.
4. Deploy temporary WAF or network controls around commerce-related paths until all instances are patched.
5. Verify role and permission configurations, remove unused commerce components, and enforce least privilege for all accounts.
6. After patching, rescan affected sites and rotate credentials or secrets if suspicious activity is found.
7. Subscribe to Drupal security advisories and track any CVE assignment or updated vendor guidance.

Source originale

BleepingComputer