CVE-2022-25275: Drupal Information Disclosure Flaw

CVE-2022-25275 Overview

CVE-2022-25275 is a significant access control vulnerability affecting the Drupal Image module. In certain configurations, the Image module fails to properly verify access permissions for image files stored outside the standard public files directory when generating derivative images through the image styles system. This vulnerability represents a broken access control flaw that can lead to unauthorized information disclosure.

The vulnerability occurs because access to non-public files is only checked when files are stored in the designated "private" file system. When contributed modules introduce additional file systems or schemes, this access verification is bypassed, potentially exposing sensitive image files to unauthorized users.

Critical Impact

Unauthorized access to private image files through the image styles system can expose sensitive media content intended to be restricted, potentially leading to data breaches and privacy violations.

Affected Products

• Drupal CMS (Multiple versions)
• Drupal 7.x installations with contributed modules providing additional file schemes
• Drupal 9.x installations with contributed modules providing additional file schemes

Discovery Timeline

• April 26, 2023 - CVE CVE-2022-25275 published to NVD
• February 03, 2025 - Last updated in NVD database

Technical Details for CVE-2022-25275

Vulnerability Analysis

This vulnerability represents a broken access control issue within Drupal's Image module. The core problem lies in the incomplete access verification logic when the image styles system processes derivative image generation requests. The Image module correctly validates access for files stored in the standard "private" file system, but this verification does not extend to files stored in custom file schemes provided by contributed modules.

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker who discovers the path to protected image files stored in non-private custom file schemes can request derivative versions through the image styles system, effectively bypassing intended access restrictions.

The vulnerability's impact is primarily focused on confidentiality, as successful exploitation allows unauthorized read access to protected image content. However, the vulnerability is mitigated by a specific configuration requirement.

Root Cause

The root cause stems from an incomplete access control check within the Image module's derivative generation logic. When processing image style requests, the module verifies file access only for files stored in Drupal's designated "private" file system scheme. The access verification logic fails to account for additional file schemes that contributed modules may introduce.

This oversight means that files stored in custom file schemes (such as those provided by Amazon S3 integration modules or other storage backends) are not subjected to the same access control verification, creating an access bypass condition.

Attack Vector

The attack vector for CVE-2022-25275 involves exploiting the image styles derivative generation system:

1. An attacker identifies that a Drupal site uses contributed modules providing additional file storage schemes
2. The attacker discovers or guesses paths to image files stored in these non-standard file schemes
3. By crafting requests to the image styles system for derivative images, the attacker can trigger generation and retrieval of processed versions of protected files
4. The Image module processes these requests without proper access verification, returning the derivative images

The vulnerability requires the site to have $config['image.settings']['allow_insecure_derivatives'] (Drupal 9) or $conf['image_allow_insecure_derivatives'] (Drupal 7) set to TRUE. The default and recommended setting is FALSE, which mitigates this vulnerability.

Detection Methods for CVE-2022-25275

Indicators of Compromise

• Unusual access patterns to image style derivative URLs from unauthenticated users
• Unexpected image derivative generation requests for files in non-public file schemes
• Access log entries showing requests to /sites/default/files/styles/ paths for images that should be restricted
• High volume of image style generation requests from single IP addresses

Detection Strategies

• Monitor web server access logs for derivative image requests targeting non-public file schemes
• Implement file integrity monitoring on image style cache directories
• Configure web application firewall rules to detect suspicious patterns in image style URLs
• Review contributed module configurations for custom file scheme usage

Monitoring Recommendations

• Enable detailed logging for image style generation events in Drupal
• Set up alerting for access attempts to protected media directories
• Audit configurations of contributed modules that provide additional file storage schemes
• Regularly review access patterns to derivative image paths in analytics tools

How to Mitigate CVE-2022-25275

Immediate Actions Required

• Verify that $config['image.settings']['allow_insecure_derivatives'] (Drupal 9) or $conf['image_allow_insecure_derivatives'] (Drupal 7) is set to FALSE
• Update Drupal core to the latest patched version as specified in the security advisory
• Audit all contributed modules that provide additional file schemes for potential exposure
• Review existing image derivative caches for potentially exposed content

Patch Information

Drupal has released security patches addressing this vulnerability. Administrators should consult the Drupal Security Advisory SA-CORE-2022-012 for specific version information and download links. After applying the patch, some sites may require configuration changes to maintain proper functionality with image files and styles.

Workarounds

• Ensure the allow_insecure_derivatives setting is set to FALSE (the default value)
• Restrict or disable contributed modules that provide custom file storage schemes until patches can be applied
• Move sensitive images to Drupal's standard private file system
• Implement web server-level access controls for custom file scheme directories

# Verify insecure derivatives setting in Drupal 9 settings.php
# Ensure this line is NOT present, or is set to FALSE:
# $config['image.settings']['allow_insecure_derivatives'] = FALSE;

# For Drupal 7, check settings.php:
# $conf['image_allow_insecure_derivatives'] = FALSE;

# Clear image style caches after configuration changes
drush cache-rebuild
drush image-flush --all